Read the docs
TI-2026-28399 Aliases CVE-2026-39417

MaxKB: RCE via MCP stdio command injection in workflow engine

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args — achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed MaxKB (1Panel-dev): 2.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-devMaxKBbefore 2.8.02.8.0Patch availableCNA
  • MaxKB Vendor1Panel-dev Affected before 2.8.0 Fixed in 2.8.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*before 2.8.0VulnerableMaxkb
  • cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:* Versions before 2.8.0 Vulnerable ·Maxkb

Remediation

  • Fix · CNA MaxKB (1Panel-dev) Fixed in 2.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39417

References

Patch 1

Advisory 1

Other 1

  • TI-2023-08712 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token CVSS 3.1CRITICAL 9.8
  • TI-2023-08729 KubeOperator is vulnerable to unauthorized access to system API CVSS 3.1CRITICAL 9.8
  • TI-2026-54047 MaxKB: Prompt-injectable agent can lead to command execution CVSS 3.1CRITICAL 10.0
  • TI-2025-43180 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences