CVE-2026-123022
Description
A flaw was found in AgentScope. A remote attacker can exploit this command injection vulnerability by submitting manipulated command parameters to the Model Context Protocol (MCP) Workspace API. Because input is passed directly to system execution functions without adequate validation, an attacker can execute arbitrary commands on the host system. This may lead to unauthorized access, data compromise, and full host takeover.
Statement
This vulnerability is rated as Critical impact because unauthenticated network users can execute arbitrary commands with the privileges of the running application, resulting in complete compromise of host confidentiality, integrity, and availability. AgentScope is not included or shipped within Red Hat Enterprise Linux or other supported Red Hat software distributions. Consequently, default Red Hat operating system deployments are not exposed to this flaw unless third-party instances of this agent framework are manually deployed and configured.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
