Is there a patch available for CVE-2026-45413?

Yes, a patch is available for CVE-2026-45413. Update the affected software to the latest version immediately.

MaxKB CVE-2026-45413

Q: What is the CVSS score of CVE-2026-45413?

CVE-2026-45413 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31984 MEDIUM

Use of Weak Hash (CWE-328)

2026-05-26 GitHub_M

Information Disclosure Maxkb

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 26, 2026 - 22:02 EUVD

Analysis Generated

May 26, 2026 - 21:36 vuln.today

CVSS changed

May 26, 2026 - 21:22 NVD

6.9 (MEDIUM)

CVE Published

May 26, 2026 - 20:12 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes, making them trivially crackable via rainbow tables or GPU-accelerated brute force (hashcat). This vulnerability is fixed in 2.9.1.

AnalysisAI

MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all user credentials to trivial offline cracking upon any database compromise. All versions prior to 2.9.1 are affected (CPE: cpe:2.3:a:1panel-dev:maxkb). The CVSS 4.0 vector (AV:L/VC:H) confirms that while local or database-level access is a prerequisite, once hashes are obtained, full credential recovery is practically guaranteed using rainbow tables or GPU-accelerated tools such as hashcat - no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

CWE-328 (Use of Weak Hash) identifies the root cause: MD5 was designed as a general-purpose integrity checksum, not a password storage primitive. It is cryptographically broken for this use case for two compounding reasons - it is computationally fast (enabling billions of guesses per second on consumer GPUs) and the absence of a per-user salt means identical plaintext passwords produce identical digests, enabling precomputed rainbow table attacks that require no brute-force effort at all. The affected product is the full MaxKB application stack (cpe:2.3:a:1panel-dev:maxkb:*:*:*:*:*:*:*:*), indicating all prior release lines are vulnerable. Secure alternatives such as bcrypt, scrypt, or Argon2id are intentionally slow and incorporate salting by design, which MaxKB 2.9.1 presumably adopts.

RemediationAI

Upgrade MaxKB to version 2.9.1, which is confirmed as the vendor-released fix per the GitHub Security Advisory GHSA-2m4c-mcq5-q8xq (https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-2m4c-mcq5-q8xq). After upgrading, administrators should force a password reset for all users, as existing hashes stored prior to the fix may have already been extracted and cracked if a prior database exposure occurred - the upgrade alone does not retroactively invalidate compromised credentials. If immediate upgrade is not possible, restrict database access to the application service account only, disable external database port exposure, and audit database backup storage permissions to limit the attack surface for hash extraction. Be aware that restricting database access does not eliminate the vulnerability - it only raises the bar for hash acquisition.