CVE-2026-123881

A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-266
• CWE-284

• https://github.com/OpenBMB/IoA/issues/20
• https://vuldb.com/cve/CVE-2026-123881
• https://vuldb.com/submit/1033651
• https://vuldb.com/vuln/432019
• https://vuldb.com/vuln/432019/cti

Published

Nov 7, 2026

Last Modified

Nov 7, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123872A client certificate authentication bypass in Node.js TLS le…8.1
• CVE-2026-123874A use-after-free in Node.js HTTP/2 lets an unauthenticated c…7.5
• CVE-2026-123875A NULL pointer dereference in Node.js HTTP/2 lets an unauthe…5.9
• CVE-2026-123876A flaw was found in the default seccomp profile used by Podm…4.4
• CVE-2026-123877A certificate validation bypass in Node.js https.Agent lets …6.8
• CVE-2026-12388A flaw was found in the Identity Provider (IdP) mapper compo…6.5
• CVE-2026-12389A vulnerability that could lead to a high privileged authent…8.4
• CVE-2026-1239The Ninja Forms – The Contact Form Builder That Grows With Y…7.5
• CVE-2026-12390In AzeoTech DAQFactory versions 21.1 and prior, a Type Confu…7.8
• CVE-2026-12391An insecure symlink following vulnerability exists in Canoni…5
• CVE-2026-12392An information exposure vulnerability in Canonical MAAS prio…5.3
• CVE-2026-12393The WPS Bookings for WooCommerce WordPress plugin before 3.1…5.4