CVE-2026-85667
Received Received - Intake

Unauthenticated Webhook Message Injection in Xiaobei

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85667
EUVD
EUVD-2026-71123

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teamwiseflow xiaobei to 5.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in xiaobei through 5.5.2 involves missing authentication or signature validation on webhook endpoints. This allows unauthenticated attackers to inject arbitrary messages into the agent pipeline by exploiting the /webhook_worktool handler. Attackers can also perform server-side request forgery by fetching unvalidated media URLs to target internal services.

Detection Guidance

Check for unauthorized access to the /webhook_worktool endpoint by monitoring web server logs for unusual POST requests or unexpected message injections. Inspect network traffic for server-side request forgery attempts targeting internal services via unvalidated media URLs.

Impact Analysis

This vulnerability can lead to unauthorized message injection, enabling attackers to manipulate agent pipelines or access internal systems. It may result in data breaches, service disruption, or further exploitation of internal services through server-side request forgery.

Compliance Impact

The vulnerability allows unauthenticated attackers to inject arbitrary messages into the agent pipeline and perform SSRF attacks against internal services. This could lead to unauthorized access to sensitive data, data exfiltration, or manipulation of systems handling personal or health information, directly violating GDPR and HIPAA compliance requirements for authentication, access control, and data integrity.

Mitigation Strategies

Implement authentication or signature validation on all webhook endpoints. Disable or restrict access to the /webhook_worktool handler until proper controls are in place. Validate and sanitize all media URLs to prevent server-side request forgery.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart