AgentScope accepted spoofed user identity headers across agent-management APIs

AgentScope Service treated a nonempty X-User-ID request header as the user principal across a broad set of agent-management APIs.

CVE-2026-123024 describes cross-user agent settings, history, credentials and scheduled-job access when clients can reach the default service without an authenticating reverse proxy. The report does not establish affected deployed tenant counts.

A nonempty X-User-ID header is an input value, not an authenticated identity. The same weakness applies across many agent-management operations because the dependency supplying user identity is shared. It can expose histories, saved credentials or scheduled actions belonging to the chosen identifier when the API is reachable without an upstream gateway enforcing that binding. The advisory describes affected releases through 2.0.11 and a proposed change, not a confirmed production victim. A proxy control works only if direct service access is blocked and the proxy overwrites the client-provided identity instead of passing it through.

A gateway can mitigate this weakness only if every affected endpoint is unreachable except through that gateway and the service cannot accept a contradictory caller-supplied identity. Test with two controlled accounts against reads, writes, histories and scheduled actions, not merely the login route. The separate AgentScope MCP-registration vulnerability can produce process execution, but the disclosures do not establish that the two weaknesses were chained in any real deployment.