XAgent EUVD-2026-56851

Exploitation requires that the XAgent ToolServerNode service is network-accessible and that open self-registration is enabled (the default configuration, which does not require email verification). An attacker must be able to reach the /workspace/file POST endpoint over the network. The depth of file access is constrained by which host directories are mounted into the ToolServerNode Docker container - deployments mounting sensitive host paths (e.g., /etc, application config directories, credential stores) face high-severity exposure, while minimal-mount configurations limit reachable files to container-internal data. No special privileges, prior knowledge of the target system, or user interaction are required. Exploitation is limited by network reachability of the ToolServerNode port and the specific volume mount configuration of the Docker deployment.

The CVSS 4.0 base score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N accurately reflects the threat: network-reachable, low complexity, no authentication barrier, and high confidentiality impact. The PR:N rating is justified by the open self-registration mechanism - any internet-accessible deployment is effectively unauthenticated. No CISA KEV listing exists and no standalone POC code has been identified, though the public fix commit exposes the exact vulnerable code path to potential researchers or threat actors. EPSS data is not available in the provided intelligence. The practical impact is bounded by what the ToolServerNode Docker container can access on the host filesystem - deployments using broad volume mounts (e.g., mounting host root or home directories) face significantly higher exposure than minimal configurations. The absence of an integrity or availability impact in the CVSS vector confirms this is a read-only information disclosure flaw. Real-world priority is high for any internet-exposed XAgent deployment, but the niche AI-agent research audience limits total exposure.

An unauthenticated external attacker registers a new XAgent account via the open self-registration endpoint (no email verification required), then issues a POST request to /workspace/file with a file_path value such as ../../../../etc/passwd or a path targeting XAgent's own config.yml containing database credentials. The server resolves the traversal sequence relative to the workspace directory without containment checks and returns the file contents. The fix commit's diff confirms the exact vulnerable code pattern - os.path.join(work_directory, file_path) with no realpath or commonpath validation - providing sufficient detail for rapid exploit construction.