Critical severity9.1NVD Advisory· Published Sep 4, 2026

CVE-2026-85667

Description

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

Affected products

TeamWiseFlow/xiaobeillm-create
Range: <=5.5.2

Patches

Vulnerability mechanics

References

github.com/TeamWiseFlow/xiaobei/blob/v5.5.2/awada/awada-server/src/routes/webhook-worktool.tsnvd
github.com/TeamWiseFlow/xiaobei/issues/440nvd
www.vulncheck.com/advisories/xiaobei-through-5.5.2-unauthenticated-webhook-message-injectionnvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000