Vulnerability · Published Nov 7, 2026 · Assigned by VulDB

CVE-2026-123881OpenBMB Internet of Agents Message app.py fetch_chat_record access control

High 7.3

In plain English

A high-severity improper access control in Internet of Agents from OpenBMB. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
OpenBMB	Internet of Agents	9d78e88e47160eb42ee1ee8538c05e1c2c47877a

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-432019 | OpenBMB Internet of Agents Message app.py fetch_chat_record access control vdb-entry, technical-description
VDB-432019 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-123881 | CVE Analysis and Report third-party-advisory
Submit #1033651 | OpenBMB Internet of Agents(IoA) 9d78e88 Improper Access Controls third-party-advisory
https://github.com/OpenBMB/IoA/issues/20 exploit, issue-tracking