CVE-2026-4957

Katalog CVE

CVSS 2.7 · Low EPSS 0,48%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada openbmb xagent. Skor CVSS 3.1 2.7 (Low) menurut vuldb.com.

Deskripsi (NVD)

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/6279f3de0c2dff7732eaaf820843b562 exploit · advisory pihak ketiga
• https://vuldb.com/?submit.777615 issue tracking · advisory pihak ketiga
• https://vuldb.com/?ctiid.353834 permissions required · vdb entry
• https://vuldb.com/?id.353834 permissions required · vdb entry