OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Agent Registry milvus_utils.py _primary_field_query key data query logic injection

Summaryinfo

A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. It has been rated as critical. This impacts the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. This manipulation of the argument key causes data query logic injection. This vulnerability is registered as CVE-2026-123791. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. It has been declared as critical. Affected by this vulnerability is the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key with an unknown input leads to a data query logic injection vulnerability. The CWE definition for the vulnerability is CWE-943. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. As an impact it is known to affect confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-123791. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

It is possible to download the exploit at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OpenBMB

Name

• Internet of Agents

Version

• 9d78e88e47160eb42ee1ee8538c05e1c2c47877a

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1033611: OpenBMB Internet of Agents(IoA) 9d78e88 Improper Neutralization of Special Elements in Data Query Logic (by Evo1ution)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion