xiaobei CVE-2026-85667

The attacker needs only network reachability to the xiaobei server's /webhook_worktool endpoint; no authentication, credentials, signature, or user interaction is required because the webhook implements no auth or signature validation. For the SSRF leg, exploitation depends on the handler's media-URL fetching being reachable and on the internal targets the server can route to (internal service IPs/ports or cloud metadata endpoints). Limiting factors: exposure requires the webhook to be network-accessible to the attacker (an internet-facing or reachable deployment), and confidentiality impact via SSRF depends on whether fetched responses are observable versus blind. Affected only through version 5.5.2 of TeamWiseFlow xiaobei.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.3) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact and no availability impact - internally consistent with an unauthenticated webhook that both injects messages (integrity) and performs SSRF that can read internal resources (confidentiality). No EPSS score, CISA KEV listing, or public POC was provided, so the concrete exploitation-probability signal is absent; the priority rests on the design nature of the flaw (missing auth is trivially reproducible) plus VulnCheck attribution rather than observed in-the-wild activity. VC:H is somewhat optimistic for SSRF whose read-back depends on the target service and whether responses are reflected - blind SSRF would justify a lower confidentiality rating - but VI:H for arbitrary message injection into the agent pipeline is well supported. Net: a genuine, easily-triggered vulnerability, tempered by the product's apparently small deployment footprint, which likely keeps real-world exploitation targeted rather than mass-scale.

An attacker who can reach the xiaobei server sends an unauthenticated POST to /webhook_worktool containing a crafted message plus a media URL pointing at an internal service (e.g., http://169.254.169.254/ or an internal admin API). The server accepts the message with no signature check, injects it into the agent pipeline, and fetches the attacker-chosen URL, letting the attacker forge internal requests and potentially exfiltrate responses. No public POC was provided, but the low attack complexity and missing authentication make reproduction straightforward.