Webhook Message Injection Vulnerability in Xiaobei from TeamWiseFlow
CVE-2026-85667

9.3CRITICAL

Key Information:

Vendor

Teamwiseflow

Status
Xiaobei
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85667?

Versions of Xiaobei through 5.5.2 are vulnerable due to a lack of authentication and signature validation on webhook endpoints. This flaw allows unauthorized attackers to send harmful messages into the agent pipeline via the /webhook_worktool handler. Moreover, the vulnerability permits the exploitation of unvalidated media URL fetching, leading to potential server-side request forgery against internal services. This could result in further system compromise or unauthorized access to internal resources.

Affected Version(s)

xiaobei 0 <= 5.5.2

References

https://github.com/TeamWiseFlow/xiaobei/issues/440
issue-tracking
https://github.com/TeamWiseFlow/xiaobei
product
https://github.com/TeamWiseFlow/xiaobei/blob/v5.5.2/awada...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.