CVE-2026-26396: OpenBMB XAgent path traversal in workspace router

CVE-2026-26396 · Severity: info · CVSS 7.5 · Published 2026-07-13

OpenBMB XAgent, an autonomous agent framework, contains a security flaw that allows unauthorized access to files on the host server. By sending a specially crafted request, an attacker can bypass security boundaries to read sensitive system files or configuration data. This could lead to the exposure of private information and provide a foothold for further attacks on the organization's infrastructure.

Technologies: OpenBMB XAgent. Vendors: OpenBMB.

Quick answers

Is CVE-2026-26396 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26396 being exploited in the wild.
How severe is CVE-2026-26396?
Informational severity, with a CVSS score of 7.5, published 13 July 2026.
Which products and versions are affected?
OpenBMB XAgent 1.0.0 and earlier.
Is there a fix for CVE-2026-26396?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26396 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26396?
Check whether you run OpenBMB XAgent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in OpenBMB XAgent versions up to and including 1.0.0. The flaw is located within the `file()` function in the `workspace.py` router, where the `file_name` (or `filename`) parameter is concatenated directly into a file path without sufficient sanitization or validation. A remote attacker can exploit this by providing a malicious string containing traversal sequences (e.g., `../../`) to escape the intended workspace directory. Successful exploitation allows the attacker to read arbitrary files on the server's filesystem that the application process has permissions to access. The vulnerability can be triggered via a POST request to the `/workspace/file` endpoint after establishing a valid interaction session.

Affected products

  • OpenBMB XAgent 1.0.0 and earlier

Timeline

  • 2026-06-18: disclosed: Initial vulnerability report shared via GitHub Gist.
  • 2026-07-13: advisory: CVE-2026-26396 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.