CVE-2026-85667 xiaobei through 5.5.2 Unauthenticated Webhook Message Injection
Unauthenticated attackers can inject messages and trigger SSRF in xiaobei due to missing webhook authentication, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85667?
CVE-2026-85667 is a critical missing authorization vulnerability in TeamWiseFlow xiaobei, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.
Weakness: CWE-306
Which versions are affected by CVE-2026-85667?
How do I fix CVE-2026-85667?
No fix has been published for CVE-2026-85667 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-85667 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85667 exists.
Sources
Also known as GHSA-g573-j843-xr77.