CVE-2026-77519— MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
Quick assessment
Affected
1Panel-dev MaxKB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the s
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 1Panel-dev | MaxKB | <= 2.10.2-lts |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77519
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
Source: CVE Program / CVE List V5
Vulnerability Description
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 1Panel-dev | MaxKB | <= 2.10.2-lts | - |
|
II. Public POCs for CVE-2026-77519
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77519
请登录查看更多情报信息。
Other References for CVE-2026-77519 (1)
Same Patch Batch · 1Panel-dev · 2026-09-21 · 13 CVEs total
| CVE-2026-77521 | 10.0 CRITICAL | MaxKB: Prompt-injectable agent can lead to command execution |
| CVE-2026-79916 | 9.1 CRITICAL | MaxKB AWS Bedrock model credential injection leads to remote code execution |
| CVE-2026-77523 | 7.4 HIGH | MaxKB: Cross-workspace model parameter form write |
| CVE-2026-79917 | 6.5 MEDIUM | MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user |
| CVE-2026-79919 | 6.3 MEDIUM | MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path c |
| CVE-2026-79918 | 6.3 MEDIUM | MaxKB: Sandbox escape via unhooked fexecve |
| CVE-2026-77520 | 5.4 MEDIUM | MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to i |
| CVE-2026-77517 | 5.4 MEDIUM | MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in |
| CVE-2026-77516 | 5.4 MEDIUM | MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path |
| CVE-2026-77518 | 5.0 MEDIUM | MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflo |
| CVE-2026-77522 | 4.3 MEDIUM | MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fo |
| CVE-2026-77525 | 4.2 MEDIUM | MaxKB: Management chat-record routes trust path application_id but load ChatRecord by glob |
IV. Related Vulnerabilities
Same product: MaxKB
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same vendor: 1Panel-dev
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same weakness: CWE-613
-
CVE-2026-86698
Refresh tokens accepted as private repository credentials at -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-92976
Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0 -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-81637
Replayable OAuth2 CSRF state retained after a failed callbac
V. Comments for CVE-2026-77519
No comments yet