Vulnerability Description
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/TeamWiseFlow/xiaobei
- https://github.com/TeamWiseFlow/xiaobei/blob/v5.5.2/awada/awada-server/src/route
- https://github.com/TeamWiseFlow/xiaobei/issues/440
- https://www.vulncheck.com/advisories/xiaobei-through-5.5.2-unauthenticated-webho
- https://github.com/TeamWiseFlow/xiaobei/issues/440
FAQ
What is CVE-2026-85667?
CVE-2026-85667 is a vulnerability with a CVSS score of 9.1 (CRITICAL). xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers...
How severe is CVE-2026-85667?
CVE-2026-85667 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-85667?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.