EUVD-2026-31987CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication. The WebhookAuth class unconditionally returns (None, {}), which Django REST Framework interprets as successful authentication. Combined with optional per-trigger token verification and no backend enforcement of token requirements, any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute their bound tasks. This vulnerability is fixed in 2.9.0.
AnalysisAI
Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke webhook trigger endpoints and execute their bound tasks. The flaw stems from the WebhookAuth class unconditionally returning a successful authentication tuple, which Django REST Framework interprets as a valid identity, combined with no backend enforcement of per-trigger token requirements. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Locate all MaxKB deployments and apply immediate network controls-restrict webhook endpoint access via firewall IP whitelisting, and disable webhooks if not actively in use. 7 days: Establish staging environment for version 2.9.0 upgrade; monitor MaxKB project for official release. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today