CVE-2026-26396: OpenBMB XAgent Path Traversal Vulnerability

CVE-2026-26396 Overview

CVE-2026-26396 is a path traversal vulnerability affecting OpenBMB XAgent version 1.0.0 and earlier. The flaw resides in the file() function located in XAgent/XAgentServer/application/routers/workspace.py. The filename parameter accepts user input and is concatenated into a file path without validation. Remote unauthenticated attackers can supply traversal sequences to read arbitrary files outside the intended workspace directory. Successful exploitation exposes sensitive host files, including configuration data, credentials, and application source code. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the XAgent server, exposing credentials, keys, and configuration data.

Affected Products

OpenBMB XAgent v1.0.0
OpenBMB XAgent versions prior to v1.0.0
XAgentServer workspace router component

Discovery Timeline

2026-07-13 - CVE-2026-26396 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-26396

Vulnerability Analysis

OpenBMB XAgent exposes an HTTP endpoint through the file() function defined in XAgent/XAgentServer/application/routers/workspace.py. The endpoint accepts a filename query parameter intended to read files from a bounded workspace directory. The implementation concatenates the user-supplied value directly into the file path used by the read operation. No canonicalization, allow-list check, or base directory containment logic is applied. Attackers can submit values containing ../ sequences or absolute paths to escape the workspace root. The server then returns the contents of the requested file in the HTTP response. See the GitHub PoC Gist for reproduction details.

Root Cause

The root cause is missing input validation on the filename parameter before it is used in a filesystem read operation. The router trusts the client-supplied path and does not resolve or verify that the final target remains within the workspace directory. This matches the [CWE-22] pattern of improper pathname limitation.

Attack Vector

Exploitation requires only network access to the XAgent HTTP interface. No authentication or user interaction is needed. An attacker issues an HTTP request to the workspace file() endpoint and supplies a filename value containing directory traversal sequences pointing to sensitive files such as /etc/passwd, application configuration files, or private keys. The server reads and returns the file content, resulting in information disclosure without any write or execution primitive.

A verified proof-of-concept is published as a GitHub PoC Gist.

Detection Methods for CVE-2026-26396

Indicators of Compromise

HTTP requests to XAgent workspace endpoints containing ../, ..%2f, or URL-encoded traversal sequences in the filename parameter.
Requests with filename values referencing absolute paths such as /etc/passwd, /proc/self/environ, or paths outside the configured workspace root.
Unexpected outbound responses from the XAgent server containing the contents of system or configuration files.

Detection Strategies

Deploy web application firewall (WAF) rules that block traversal patterns in query parameters targeting the /workspace/file route.
Enable verbose access logging on the XAgent HTTP interface and alert on filename values that do not resolve within the workspace base directory.
Correlate file read operations by the XAgent process with the intended workspace root using host-based file access telemetry.

Monitoring Recommendations

Monitor the XAgent server process for reads of sensitive files outside its working directory, such as /etc/, /root/, or user home directories.
Track HTTP 200 responses from the workspace router that return unusually large payloads or content types inconsistent with workspace files.
Review authentication and network exposure of XAgent deployments to confirm the service is not reachable from untrusted networks.

How to Mitigate CVE-2026-26396

Immediate Actions Required

Restrict network access to the XAgent server so the HTTP interface is not exposed to untrusted networks or the public internet.
Place XAgent behind an authenticating reverse proxy that filters traversal sequences in request parameters.
Rotate any credentials, API keys, or tokens stored on hosts running vulnerable XAgent versions, since file disclosure may have occurred.

Patch Information

No vendor patch is referenced in the published CVE record at this time. Operators should monitor the OpenBMB XAgent repository for a fixed release. Any fix must canonicalize the resolved path and confirm it remains within the workspace base directory before opening the file.

Workarounds

Run XAgent in an isolated container or chroot with only the workspace directory mounted, limiting the filesystem an attacker can reach.
Apply a reverse proxy rule that rejects requests to the workspace file endpoint when the filename parameter contains .., %2e%2e, backslashes, or leading /.
Enforce least-privilege file permissions so the XAgent service account cannot read sensitive host files or other tenants' data.

bash

# Example NGINX rule blocking traversal in the filename parameter
location /workspace/file {
    if ($arg_filename ~* "(\.\./|\.\.\\|%2e%2e|^/)") {
        return 403;
    }
    proxy_pass http://xagent_backend;
}