CVE-2026-85667

    Dashboard / Vulnerabilities / CVE-2026-85667

    CVE-2026-85667

    Published: 4 Sept 2026Last Modified: 12 Sept 2026

    Summary: xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

    Details: xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85667.json, https://nvd.nist.gov/vuln/detail/CVE-2026-85667, https://www.vulncheck.com/advisories/xiaobei-through-5.5.2-unauthenticated-webhook-message-injection, https://github.com/TeamWiseFlow/xiaobei/issues/440, https://github.com/TeamWiseFlow/xiaobei, https://github.com/TeamWiseFlow/xiaobei/blob/v5.5.2/awada/awada-server/src/routes/webhook-worktool.ts

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -48bfeda032605e85a3a8eccc6e0f4d3eb8b6a11f

    Affected versions

    v5.5.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85667 | CVE-DB