Description

A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-11-06T22:17:50.903Z",
  "pubdate": "2026-11-06T22:17:50.903Z",
  "executiveSummary": "A critical injection vulnerability has been identified within the Agent Registry component of OpenBMB Internet of Agents, specifically affecting the _primary_field_query function located in common/utils/milvus_utils.py.\nThe vulnerability arises from improper neutralization of special elements in data query logic, specifically within the 'key' argument.\nThis flaw allows for remote code execution or unauthorized data manipulation by an unauthenticated attacker, as the input is processed without sufficient sanitization before interacting with the underlying Milvus database.\nGiven that the project operates on a rolling release model and lacks a definitive fix, the risk remains high for deployments utilizing code up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a.\nThe exposure of this vulnerability is global, as the exploit vector can be triggered remotely, bypassing standard interface controls if the query interface is exposed to untrusted input.\nThe inability to restrict query logic via parameterization suggests a fundamental flaw in the interaction layer between the application and the vector database.",
  "technicalDetails": "The vulnerability resides in the _primary_field_query function within common/utils/milvus_utils.py, which serves as an interface layer for the Milvus vector database.\nThe root cause is an improper neutralization of user-supplied input provided to the 'key' argument, which is concatenated directly into query logic without adequate sanitization or structural validation.\nBy manipulating the 'key' argument, an attacker can perform a query injection attack, effectively altering the intended structure of the Milvus database query string.\nIn a standard execution flow, the application calls _primary_field_query to retrieve information about agents stored in the registry. An attacker sends a crafted remote request containing malicious syntax designed to break out of the intended query parameter.\nBecause the input is not parameterized, the database interpreter executes the injected logic alongside the original query. This allows an attacker to bypass data filtering, access unauthorized records, or potentially perform unauthorized data modifications depending on the privileges assigned to the database user account used by the Agent Registry.\nThe exploit path involves the following steps: 1) Identification of an input vector that passes data to the _primary_field_query function; 2) Crafting a payload that terminates the intended query expression and inserts custom filter clauses or operators; 3) Injecting the payload into the 'key' field of the remote request; 4) Sending the request to the application, triggering the vulnerable function to execute the injected database commands.\nThe impact is significant, as successful exploitation facilitates unauthorized access to private registry data, potential exfiltration of sensitive agent configurations, or the disruption of agent registry operations through database command manipulation.\nNo authentication is required if the endpoint accepting the query parameter is network-accessible, expanding the threat landscape significantly.\nAs the project utilizes a rolling release architecture, there are no specific version numbers to track; the vulnerability is present in all iterations up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The lack of a vendor response to the initial issue report indicates that this vector remains unpatched and actively exploitable by external actors."
}