PT-2026-28683 · Openbb · Xagent

Eric-Z + 1 · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-4957

Mitre

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle tool call of the file XAgent/function handler.py of the component API Key Handler. This manipulation of the argument api key causes sensitive information in log files. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

Related Identifiers

CVE-2026-4957

Affected Products

Xagent

References · 5

• 🔥 https://gist.github.com/YLChen-007/6279f3de0c2dff7732eaaf820843b562 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4957 · Security Note
• https://vuldb.com/?ctiid.353834 · Note
• https://vuldb.com/?id.353834 · Note
• https://vuldb.com/?submit.777615 · Note