CVE-2026-77518— MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
Quick assessment
Affected
1Panel-dev MaxKB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the p
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 1Panel-dev | MaxKB | <= 2.10.2-lts |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77518
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
Source: CVE Program / CVE List V5
Vulnerability Description
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcp_tool_id in a workflow mcp-node so workflow debug uses the owner's MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 1Panel-dev | MaxKB | <= 2.10.2-lts | - |
|
II. Public POCs for CVE-2026-77518
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77518
请登录查看更多情报信息。
Other References for CVE-2026-77518 (1)
Same Patch Batch · 1Panel-dev · 2026-09-21 · 13 CVEs total
| CVE-2026-77521 | 10.0 CRITICAL | MaxKB: Prompt-injectable agent can lead to command execution |
| CVE-2026-79916 | 9.1 CRITICAL | MaxKB AWS Bedrock model credential injection leads to remote code execution |
| CVE-2026-77523 | 7.4 HIGH | MaxKB: Cross-workspace model parameter form write |
| CVE-2026-79917 | 6.5 MEDIUM | MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user |
| CVE-2026-79919 | 6.3 MEDIUM | MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path c |
| CVE-2026-79918 | 6.3 MEDIUM | MaxKB: Sandbox escape via unhooked fexecve |
| CVE-2026-77520 | 5.4 MEDIUM | MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to i |
| CVE-2026-77517 | 5.4 MEDIUM | MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in |
| CVE-2026-77516 | 5.4 MEDIUM | MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path |
| CVE-2026-77519 | 5.4 MEDIUM | MaxKB: Expired application API keys remain usable on `/chat/api/mcp` |
| CVE-2026-77522 | 4.3 MEDIUM | MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fo |
| CVE-2026-77525 | 4.2 MEDIUM | MaxKB: Management chat-record routes trust path application_id but load ChatRecord by glob |
IV. Related Vulnerabilities
Same product: MaxKB
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same vendor: 1Panel-dev
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same weakness: CWE-862
-
CVE-2026-17618
IBM Financial Transaction Manager (FTM) is Impacted by Multi -
CVE-2026-63104
Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task En -
CVE-2026-77243
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass -
CVE-2026-43643
Softaculous Virtualizor Authorization Bypass via Billing Mod -
CVE-2026-94384
Missing Authorization in sfExecuteAWSService Lambda Dispatch
V. Comments for CVE-2026-77518
No comments yet