CVE-2026-4957 | OpenBMB XAgent 1.0.0 API Key function_handler.py FunctionHandler.handle_tool_call api_key log file

A vulnerability marked as problematic has been reported in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files.

This vulnerability appears as CVE-2026-4957. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.