by Kastro
Paper/Archive/CVE-2026-85667

CVE-2026-85667

TeamWiseFlow xiaobei — xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

EPSS 0.7%public exploitCVSS 9.3
critical.is priorityof 100
49
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 53.0.530 × 2010.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

Affected

ProductAffectedFixed inSource
xiaobei≤ 5.5.2–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/TeamWiseFlow/xiaobei/issues/440refgithub.com/TeamWiseFlow/xiaobeiwriteupgithub.com/TeamWiseFlow/xiaobei/blob/v5.5.2/awada/awada-server/src/routes/webhook-worktool.tswriteupvulncheck.com/advisories/xiaobei-through-5.5.2-unauthenticated-webhook-message-injection