xiaobei Webhook Authentication Bypass and SSRF Vulnerability

Technical Analysis

CVE-2026-85667 (CVSS 9.1) stems from missing authentication and signature validation on the /webhook_worktool endpoint, allowing any unauthenticated actor to publish crafted messages into the agent message processing pipeline. The unvalidated media URL fetching component compounds this risk by permitting attacker-controlled URLs to be requested by the server, enabling SSRF attacks that can reach internal-only services, cloud metadata endpoints, or bypass network segmentation. This is a classic missing-authorization-plus-SSRF chain: attackers can both spoof legitimate webhook traffic and pivot from the vulnerable service into internal infrastructure. Because this vulnerability directly targets an agent message-processing pipeline, any AI agent system built on or integrating xiaobei is exposed to attacker-injected commands, prompt injection via spoofed messages, and potential exfiltration of internal credentials or metadata through the SSRF vector, making this a direct and severe threat to agent-based deployments.

Affected Systems

xiaobei versions through 5.5.2, specifically the /webhook_worktool endpoint handler and any deployment exposing webhook-based agent message ingestion without an authentication or reverse-proxy layer in front of it

Indicators of Compromise

• Endpoint: /webhook_worktool
• Suspicious pattern: unauthenticated POST requests to webhook handler
• Suspicious pattern: outbound requests to internal IP ranges (169.254.169.254, 10.x.x.x, 192.168.x.x) originating from media URL fetch functionality

Remediation Steps

1. 1

   Upgrade xiaobei

   Update to a patched version beyond 5.5.2 once available from the vendor; monitor vendor advisories for a fix release.

2. 2

   Implement authentication on webhook endpoints

   Add HMAC signature validation, API keys, or mutual TLS on the /webhook_worktool endpoint until a patch is applied.

3. 3

   Restrict outbound network access

   Apply egress filtering and network segmentation to prevent the media URL fetching feature from reaching internal services or cloud metadata endpoints.

4. 4

   Deploy a WAF or reverse proxy

   Place a web application firewall in front of webhook endpoints to block unauthenticated or anomalous requests as a compensating control.

5. 5

   Audit agent pipeline logs

   Review logs for unexpected or unauthorized messages injected into the agent pipeline, and validate all message sources retroactively.

6. 6

   Validate and allowlist media URLs

   Implement strict URL validation and allowlisting for any media-fetching functionality to prevent SSRF exploitation.