PT-2026-28683 · Openbb · Xagent

Eric-Z + 1 · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-4957

Mitre

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle tool call of the file XAgent/function handler.py of the component API Key Handler. This manipulation of the argument api key causes sensitive information in log files. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Correção

Information Disclosure

Insertion into Log File

Enumeração de Fraquezas

CWE-200

CWE-532

Identificadores relacionados

CVE-2026-4957

Produtos afetados

Xagent

Referências · 5

• 🔥 https://gist.github.com/YLChen-007/6279f3de0c2dff7732eaaf820843b562 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4957 · Nota de Segurança
• https://vuldb.com/?ctiid.353834 · Nota
• https://vuldb.com/?id.353834 · Nota
• https://vuldb.com/?submit.777615 · Nota