1panel Dev's MaxKB: Thirteen Vulnerabilities Including Critical Flaws Disclosed Together
Thirteen vulnerabilities, including two critical flaws, were disclosed for 1panel Dev's MaxKB AI assistant on September 21, 2026, affecting versions up to 2.10.4-lts.
Key findings
- Thirteen vulnerabilities disclosed simultaneously for 1panel Dev's MaxKB on September 21, 2026.
- Critical flaws (CVSS 9.1-10.0) include AWS credential compromise and unapproved shell execution.
- Multiple vulnerabilities stem from improper authorization and access control checks in API endpoints.
- Sandbox escape vulnerabilities allow bypassing security controls and executing unauthorized code.
- Affected versions range from 2.0.0 up to 2.10.4-lts; update to 2.10.6-lts or later.
On September 21, 2026, a batch of thirteen vulnerabilities was disclosed for 1panel Dev's MaxKB, an open-source AI assistant for enterprise. The vulnerabilities, ranging in severity from Medium to Critical, were all disclosed on the same day, indicating a coordinated disclosure event. These flaws could allow authenticated attackers to bypass security controls, execute arbitrary code, and access sensitive information.
Several vulnerabilities stem from improper authorization and access control checks within MaxKB's API endpoints and internal functions. For instance, CVE-2026-79917 highlights an issue where the POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint verifies conversation existence but fails to confirm ownership by the authenticated user or the application's token. Similarly, CVE-2026-77525 demonstrates that management chat-record routes authorize based on application_id but load records globally without verifying ownership. CVE-2026-77523 involves a model parameter form route that authorizes by workspace but deserializes models without including workspace_id in the query, allowing users with model read permission in one workspace to potentially access models in another. CVE-2026-77518 details how a normal workspace user can retrieve a hidden MCP tool if they know its ID, as the tool-detail route bypasses per-resource authorization. CVE-2026-77517 shows that document and paragraph operate routes authorize only knowledge_id but query documents/paragraphs without confirming they belong to that knowledge base. Finally, CVE-2026-77516 indicates that authenticated workspace members can inject control characters into AWS credential fields, overwriting the /root/.aws/credentials file due to unsafe parsing.
Other vulnerabilities focus on sandbox escapes and improper handling of external interactions. CVE-2026-79919 describes how function-library code within the LD_PRELOAD sandbox can use ctypes.CDLL to bypass importlib.abc.MetaPathFinder callbacks and invoke unhooked dlsym with RTLD_NEXT. CVE-2026-79918 points out that while the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat, it fails to hook fexecve, allowing authenticated attackers to execute subprocesses outside the sandbox. CVE-2026-77522 reveals that the knowledge web-document import crawler passes a user's URL to Fork.fork which uses requests.get with verify=False and no restrictions on schemes or private/loopback addresses, potentially leading to SSRF. CVE-2026-77521 describes a critical flaw where assistants with tools, MCP tools, skills, or sub-applications use SandboxShellBackend, exposing an execute shell tool without requiring human approval due to execute being omitted from interrupt_on.
Further issues include information disclosure and authentication bypasses. CVE-2026-77520 details how a normal user can obtain another user's application_id from the homepage application question-ranking endpoint under specific conditions. CVE-2026-77519 notes that the /chat/api/mcp authentication path uses only the secret and active status to look up an ApplicationApiKey, neglecting permanent and expiration checks. CVE-2026-77516 indicates that even lowest-role workspace members denied access to a tool can still execute it through agent or workflow dispatch paths by binding its identifier.
The critical vulnerabilities, CVE-2026-79916 and CVE-2026-77521, carry CVSS scores of 9.1 and 10.0 respectively, highlighting the significant risk they pose. The affected versions for most of these vulnerabilities are prior to 2.10.6-lts, with specific versions mentioned for some flaws (e.g., 2.10.4-lts for CVE-2026-79917, 2.10.5-lts for CVE-2026-79916 and CVE-2026-77521, 2.10.3-lts for CVE-2026-77523 and CVE-2026-77522, 2.10.2-lts for CVE-2026-77525, CVE-2026-77520, CVE-2026-77519, CVE-2026-77518, CVE-2026-77517, and 2.9.2 for CVE-2026-77516). Users are strongly advised to update to version 2.10.6-lts or later to mitigate these security risks. The coordinated disclosure of these thirteen vulnerabilities underscores the importance of timely patching and security diligence for MaxKB users.
The vulnerabilities disclosed on September 21, 2026, for 1panel Dev's MaxKB present a range of security risks, from critical remote code execution to medium-severity information disclosure. The critical flaws, CVE-2026-79916 and CVE-2026-77521, are particularly concerning, allowing for the modification of AWS credentials and unapproved shell execution, respectively. The batch of thirteen CVEs, all disclosed simultaneously, emphasizes the need for users to promptly apply updates. The affected versions span a significant range, with fixes available in version 2.10.6-lts and later. Staying current with MaxKB updates is crucial for maintaining the security posture of enterprise AI assistant deployments.