CVE-2026-85667: Missing Authentication for Critical Function in TeamWiseFlow xiaobei

CVE-2026-85667 affects TeamWiseFlow xiaobei through version 5.5.2. The product fails to implement authentication or signature validation on its webhook endpoints, specifically the /webhook_worktool handler. This flaw permits unauthenticated attackers to inject arbitrary messages into the agent pipeline. Additionally, the vulnerability enables exploitation of unvalidated media URL fetching, allowing server-side request forgery (SSRF) attacks against internal services. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Unauthenticated attackers can inject arbitrary messages into the system's agent pipeline, potentially disrupting operations or injecting malicious content. The SSRF capability allows attackers to make internal network requests, which could lead to information disclosure or further internal exploitation. The vulnerability poses a critical risk to confidentiality and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to webhook endpoints and monitor for suspicious activity. Implement custom authentication or validation mechanisms on webhook handlers if possible.