EUVD-2026-22162Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args - achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0.
AnalysisAI
Remote code execution in MaxKB workflow engine (versions 2.7.1 and below) allows authenticated users to bypass an incomplete CVE-2025-53928 fix by injecting arbitrary MCP node configurations through the workflow creation API. An attacker with low-privilege credentials can omit the mcp_source field to trigger the unpatched else branch, inject stdio transport with arbitrary commands, and achieve RCE when the workflow is executed via chat interaction. This represents an incomplete remediation of a prior vulnerability-the patch restricted one code path but left an alternative execution path fully exposed.
Technical ContextAI
MaxKB's workflow engine processes MCP (Model Context Protocol) node configurations that can execute arbitrary system commands via stdio transport. The original CVE-2025-53928 attempted to restrict RCE by validating the mcp_source field when loading MCP server configurations from the database. However, the workflow creation API accepts user-supplied JSON that can define mcp_servers directly inline. The vulnerability stems from improper input validation (CWE-20: Improper Input Validation) in the conditional logic: the patched branch validates database-sourced configs, but the else branch-which handles direct JSON payloads-remains completely unvalidated. Because mcp_source is optional (required=False in the API schema), an attacker can craft a workflow JSON with mcp_servers containing arbitrary command definitions that bypass validation entirely. When the workflow is triggered, the MCP node instantiates these commands and executes them with the privileges of the MaxKB service process.
RemediationAI
Upgrade MaxKB immediately to version 2.8.0 or later, which includes the complete fix for this vulnerability (confirmed via GitHub commit 50e96002ee5dca34c68d3d9333b64ea358c92304). If immediate upgrade is not possible, disable the workflow engine feature entirely or restrict API access to the workflow creation endpoint (/api/workflows or equivalent) to trusted administrators only via network ACLs or reverse proxy rules. Additionally, audit all existing workflows created in versions 2.7.1 and below for suspicious MCP node configurations with stdio transport and arbitrary command definitions. The vendor's security advisory is available at https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xj and the fix commit at https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304.
MaxKB prior to version 1.10.8-lts contains an incomplete sandbox implementation that only blacklists binary execution in
Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role
OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated
Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke we
Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to
Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript thr
MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based s
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by expl
Server-side request forgery in MaxKB v2.8.0 and earlier allows authenticated low-privilege users to reach internal netwo
Server-Side Request Forgery in MaxKB before 2.9.1 allows authenticated users to pivot into internal network infrastructu
OS command injection in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to execute arbitrary
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today