CVE-2026-123791: IoA Agent Registry: Milvus query injection via key

HIGH

Published November 6, 2026

CISO Take

OpenBMB Internet of Agents (IoA) has a query-injection flaw in the Agent Registry: the `key` argument to `_primary_field_query` in `common/utils/milvus_utils.py` is not neutralized before being placed in a Milvus filter expression (CWE-943). It is reachable over the network without authentication or user interaction, scores CVSS 7.3, and a public exploit is referenced in the project's GitHub issue. Even so, the data does not point to broad exploitation: it is not in CISA KEV, no EPSS score is available, no Nuclei template exists, and the package has no tracked dependents. The project is rolling-release with no versioned fixes, and the maintainers have not responded to the report, so do not expect a vendor patch. If you run IoA, keep the Agent Registry off untrusted networks, put an authenticated gateway in front of it, and add input validation on `key` yourself.

Sources:NVDATLASvuldb.comGitHub Issues (OpenBMB/IoA)

What is the risk?

High per CVSS 7.3 (network-reachable, low complexity, no privileges, no user interaction; low confidentiality, integrity and availability impact). Practical risk is moderate. IoA is a niche research-grade multi-agent framework with no tracked downstream dependents, EPSS is unavailable, and there is no KEV listing or SSVC decision. A public proof of concept exists in the project's issue tracker, and the maintainers have not responded, so the exposure is unlikely to be fixed upstream. Impact is limited to the registry's Milvus queries, but registry data feeds agent discovery and routing, so tampering or leakage has knock-on effects.

How does the attack unfold?

Initial Access

Attacker locates an exposed IoA Agent Registry endpoint reachable over the network.

AML.T0049

Exploitation

Attacker sends a crafted `key` value that injects Milvus filter expression syntax into _primary_field_query.

AML.T0049

Collection

The manipulated query returns agent records beyond the intended scope, exposing registry data.

AML.T0036

Impact

Leaked agent metadata enables targeting or impersonation of agents, and malformed queries can degrade registry availability.

Initial Access

Attacker locates an exposed IoA Agent Registry endpoint reachable over the network.

AML.T0049

Exploitation

Attacker sends a crafted `key` value that injects Milvus filter expression syntax into _primary_field_query.

AML.T0049

Collection

The manipulated query returns agent records beyond the intended scope, exposing registry data.

AML.T0036

Impact

Leaked agent metadata enables targeting or impersonation of agents, and malformed queries can degrade registry availability.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Milvus	pip	—	No patch
1.4KOpenSSF 5.47 dependentsPushed 9d ago25% patched~41d to patchFull package profile →
Internet of Agents	—	—	No patch

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) No fixed version exists, so track the OpenBMB/IoA repository and issue #19 for a patch and pin to a reviewed commit. 2) Until then, patch _primary_field_query locally: validate key against a strict allowlist (for example, alphanumeric and a limited set of separators) and escape or parameterize values before building the Milvus filter expression. 3) Restrict network access to the Agent Registry using a firewall, VPN or private network, and put it behind an authenticated reverse proxy or API gateway. 4) Run Milvus with least-privilege credentials and read-only access where possible, and avoid exposing the Milvus port directly. 5) Detect: log and alert on registry requests whose key contains quote characters, boolean operators, brackets or filter-expression syntax, and watch for unusually large result sets or query errors in Milvus logs. 6) Consider replacing IoA in production-facing roles if the project stays unmaintained.

How is it classified?

Data ExtractionDoSAgentFrameworkRAGAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0084- Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party AI components

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-123791?

Is CVE-2026-123791 actively exploited?

No confirmed active exploitation of CVE-2026-123791 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123791?

1) No fixed version exists, so track the OpenBMB/IoA repository and issue #19 for a patch and pin to a reviewed commit. 2) Until then, patch `_primary_field_query` locally: validate `key` against a strict allowlist (for example, alphanumeric and a limited set of separators) and escape or parameterize values before building the Milvus filter expression. 3) Restrict network access to the Agent Registry using a firewall, VPN or private network, and put it behind an authenticated reverse proxy or API gateway. 4) Run Milvus with least-privilege credentials and read-only access where possible, and avoid exposing the Milvus port directly. 5) Detect: log and alert on registry requests whose `key` contains quote characters, boolean operators, brackets or filter-expression syntax, and watch for unusually large result sets or query errors in Milvus logs. 6) Consider replacing IoA in production-facing roles if the project stays unmaintained.

What systems are affected by CVE-2026-123791?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, vector databases, multi-agent orchestration, agent registries.

What is the CVSS score for CVE-2026-123791?

CVE-2026-123791 has a CVSS v3.1 base score of 7.3 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksvector databasesmulti-agent orchestrationagent registries

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0084Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker finds an Internet-reachable IoA Agent Registry and sends a request with a crafted `key` value containing Milvus filter syntax such as quote-breaking and an always-true condition. The registry builds its query with the unsanitized string, so the filter returns every agent record instead of one. The attacker harvests agent identifiers, endpoints and capability descriptions, then uses that knowledge to impersonate or target specific agents in the network. Repeated malformed or expensive filters can also degrade registry availability for the whole agent mesh.

Weaknesses (CWE)

CWE-20Improper Input Validation CWE-943Improper Neutralization of Special Elements in Data Query Logic

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.