CVE-2026-4957: OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file

Published Mar 27, 2026

Updated

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handletoolcall of the file XAgent/functionhandler.py of the component API Key Handler. This manipulation of the argument apikey causes sensitive information in log files. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

OpenBMB OpenBMB XAgent=1.0.0

OpenBMB XAgent=1.0.0

Event History

Mar 27, 2026

CVE Published

via MITRE·02:52 PM

Data Sourced

via MITRE·02:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-4957?

CVE-2026-4957 is considered a high severity vulnerability due to its potential for exposing sensitive API keys.

How do I fix CVE-2026-4957?

To fix CVE-2026-4957, update OpenBMB XAgent to the latest version that addresses this vulnerability.

What does the CVE-2026-4957 vulnerability affect?

CVE-2026-4957 affects the API Key Handler in the FunctionHandler.handle_tool_call function of OpenBMB XAgent version 1.0.0.

Can CVE-2026-4957 lead to data exposure?

Yes, CVE-2026-4957 can lead to data exposure by allowing unauthorized access to API keys.

Is CVE-2026-4957 commonly exploited?

While there are no specific reports of exploitation, high severity vulnerabilities like CVE-2026-4957 are often targeted in the wild.