What is the CVSS score of CVE-2026-26396?

CVE-2026-26396 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of N A are affected by CVE-2026-26396?

OpenBMB XAgent v1.0.0 and earlier contains a file path traversal vulnerability allowing remote file disclosure through the workspace router's file endpoint.

How to fix or mitigate CVE-2026-26396?

Within 24 hours: Identify all OpenBMB XAgent v1.0.0 and earlier deployments in your environment; restrict network access to the XAgentServer workspace file() endpoint using firewall rules, WAF policies, or network segmentation; review access logs for suspicious file access patterns. Within 7 days: Conduct forensic log analysis to identify any unauthorized file reads; classify the sensitivity of files potentially accessible through the affected endpoint; contact OpenBMB vendor to confirm patch availability and timeline. Within 30 days: Deploy detection rules to alert on path traversal attempts targeting this endpoint; establish a remediation plan including either patching once available or removing XAgent from your architecture if vendor timelines are unacceptable.

N A CVE-2026-26396

HIGH

Path Traversal (CWE-22)

2026-07-13 mitre

Path Traversal Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:20 vuln.today

CVSS changed

Jul 13, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jul 13, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.

AnalysisAI

Sensitive information disclosure in OpenBMB XAgent v1.0.0 and earlier allows remote unauthenticated attackers to read arbitrary files on the server by abusing a path traversal flaw in the file() endpoint of XAgentServer's workspace router. The user-controllable 'filename' parameter is concatenated into a file path without validation, so a crafted request escapes the intended workspace directory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Identify all OpenBMB XAgent v1.0.0 and earlier deployments in your environment; restrict network access to the XAgentServer workspace file() endpoint using firewall rules, WAF policies, or network segmentation; review access logs for suspicious file access patterns. …

Threat intelligence, references, and detailed analysis are available after sign-in.