AgentScope MCP workspace registration spawned unchecked server commands

AgentScope Service registered arbitrary stdio MCP configurations through its workspace API and connected immediately, spawning the supplied command before any meaningful authorization or protocol negotiation.

CVE-2026-123022 describes unauthenticated exposure in default installations without a protecting gateway. The supplied X-User-ID header was not sufficient evidence of caller identity. No real-world breach was established.

The entry point is the workspace MCP registration API, not an already running tool call. Accepting a client-supplied stdio configuration makes the requested executable part of server setup, so connection itself has an effect before any later MCP permission check could reject a tool invocation. The published advisory lists AgentScope through 2.0.11 and a proposed repair, but does not identify a released patched version. That matters when assessing exposure: a private, authenticated gateway can remove the untrusted caller prerequisite without proving the underlying command-spawning code safe.

The dangerous operation occurs during workspace setup, before an agent invokes any MCP tool. A control that reviews tools/call requests cannot stop a command already spawned by registering its server. The companion AgentScope user-header defect concerns who can claim a workspace identity; this one concerns which executable that identity can start. Both boundaries require separate tests, including direct access that bypasses an authenticating reverse proxy. The advisory does not establish that a patched release has closed the command-launch path.