MaxKB CVE-2026-79916

Requires an authenticated MaxKB workspace member (PR:L) on a pre-2.10.5-lts instance where the AWS Bedrock model provider path is reachable. The attacker must (1) inject control/newline characters into the access_key_id or secret_access_key fields that _update_aws_credentials writes unsafely into /root/.aws/credentials, forging a new profile containing a credential_process directive, and (2) issue a subsequent model-validation request that selects the injected profile so botocore invokes the process. Code executes as root because MaxKB writes to and reads /root/.aws/credentials as root, so the impact is gated on the service running with root privileges. Limiting factors: valid workspace credentials, use of the Bedrock provider, and the two-step inject-then-trigger sequence.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, 9.1) describes network-reachable exploitation by a low-privileged authenticated user, and the underlying mechanism - CWE-78 command injection culminating in botocore executing an attacker-controlled command via a crafted credential_process AWS profile - yields code execution as root, which is more severe than the vendor's I:L/A:L impact suggests (full root RCE warrants I:H/A:H). No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis'; however, the fix commit (a1e413d1), PR #6418 diff, and GHSA-2324-7xjr-9qxg advisory are all published, giving skilled attackers a clear roadmap to the vulnerable pre-2.10.5-lts logic. The main tempering factor is the PR:L requirement (an authenticated workspace member) plus the need for the AWS Bedrock provider path - genuine but modest gates for an enterprise self-hosted tool. No signals conflict; the only discrepancy is vendor impact scoring versus the described root-RCE outcome, noted above.

An authenticated MaxKB workspace member configures an AWS Bedrock model and injects control characters (newlines) into the access_key_id/secret_access_key fields, which _update_aws_credentials writes verbatim into /root/.aws/credentials, appending a rogue AWS profile containing a credential_process directive. The attacker then issues a later model-validation request selecting that profile, causing botocore to execute the attacker-specified command as root. No public exploit is identified, but the patch diff and advisory disclose the exact vulnerable parsing path.