What’s Vulnerable › Products

OpenBMB XAgent vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your OpenBMB XAgent version is affected

Latest OpenBMB XAgent vulnerabilities

• CVE-2026-72713 — XAgent Path Traversal Arbitrary File Read via /workspace/file (CVSS 7.5)
• CVE-2026-4959 — OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication (CVSS 7.5)
• CVE-2026-4958 — OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization (CVSS 6.5)
• CVE-2026-4957 — OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file (CVSS 2.7)
• CVE-2026-3954 — OpenBMB XAgent workspace.py workspace path traversal (CVSS 6.5)
• CVE-2025-6281 — OpenBMB XAgent community path traversal (CVSS 6.3)
• CVE-2024-2007 — OpenBMB XAgent Privileged Mode sandbox (CVSS 8.8)