CVE-2026-123024: Missing Authentication Vulnerability Published for AgentScope

A missing-authentication vulnerability, tracked as CVE-2026-123024, was published to the National Vulnerability Database on 5 November 2026. The issue affects AgentScope versions up to and including 2.0.11, an open-source agent framework developed by Alibaba, specifically the Agent Service component in the get_current_user_id function of src/agentscope/app/deps.py. User identity is read from the client-controlled X-User-ID header without cryptographic verification, allowing a remote attacker to impersonate any user.

A public exploit is already available. The NVD record is currently in Deferred status, with no CVSS score assigned and no patched version listed at the time of publication. Operators running affected versions are advised to avoid exposing deployments to untrusted networks until a fixed release becomes available. The vulnerability illustrates a recurring design flaw in agent platforms: identity taken from client-controlled headers without verification.