CVE-2026-77516— MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path
Quick assessment
Affected
1Panel-dev MaxKB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 1Panel-dev | MaxKB | >= 2.0.0, <= 2.9.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77516
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path
Source: CVE Program / CVE List V5
Vulnerability Description
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it through the agent or workflow dispatch path. The dispatch path does not reapply the per-tool grant enforced by dedicated tool routes, and tool execution decrypts server-side init_params, allowing the caller to receive credentials carried by the denied tool. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 1Panel-dev | MaxKB | >= 2.0.0, <= 2.9.2 | - |
|
II. Public POCs for CVE-2026-77516
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77516
请登录查看更多情报信息。
Other References for CVE-2026-77516 (1)
Same Patch Batch · 1Panel-dev · 2026-09-21 · 13 CVEs total
| CVE-2026-77521 | 10.0 CRITICAL | MaxKB: Prompt-injectable agent can lead to command execution |
| CVE-2026-79916 | 9.1 CRITICAL | MaxKB AWS Bedrock model credential injection leads to remote code execution |
| CVE-2026-77523 | 7.4 HIGH | MaxKB: Cross-workspace model parameter form write |
| CVE-2026-79917 | 6.5 MEDIUM | MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user |
| CVE-2026-79919 | 6.3 MEDIUM | MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path c |
| CVE-2026-79918 | 6.3 MEDIUM | MaxKB: Sandbox escape via unhooked fexecve |
| CVE-2026-77520 | 5.4 MEDIUM | MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to i |
| CVE-2026-77517 | 5.4 MEDIUM | MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in |
| CVE-2026-77519 | 5.4 MEDIUM | MaxKB: Expired application API keys remain usable on `/chat/api/mcp` |
| CVE-2026-77518 | 5.0 MEDIUM | MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflo |
| CVE-2026-77522 | 4.3 MEDIUM | MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fo |
| CVE-2026-77525 | 4.2 MEDIUM | MaxKB: Management chat-record routes trust path application_id but load ChatRecord by glob |
IV. Related Vulnerabilities
Same product: MaxKB
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same vendor: 1Panel-dev
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same weakness: CWE-639
-
CVE-2026-75101
Authorization bypass vulnerability in GitHub Enterprise Serv -
CVE-2026-77426
Unleash: Missing await on permission check + cross-project I -
CVE-2026-77425
Unleash: A project member can reorder activation strategies -
CVE-2026-76910
Unleash: Clone-feature lets a user copy a feature from a pro -
CVE-2026-94462
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:
V. Comments for CVE-2026-77516
No comments yet