Remote Code Execution Vulnerability in MaxKB AI Assistant from 1Panel
CVE-2026-39417
4.6MEDIUM
What is CVE-2026-39417?
MaxKB, an open-source AI assistant for enterprise, is vulnerable to a remote code execution issue due to an incomplete fix in versions prior to 2.8.0. The vulnerability allows attackers to bypass existing security measures and inject malicious MCP node configurations via a crafted JSON payload. Specifically, the incomplete restriction on loading MCP configurations means that an attacker can manipulate input and potentially execute arbitrary commands when workflows are triggered. This flaw poses a significant risk for organizations using MaxKB for their operations. Users are advised to upgrade to version 2.8.0 or later to mitigate this vulnerability.
Affected Version(s)
MaxKB < 2.8.0