Broken Access Control in MaxKB Open-Source AI Assistant from 1Panel
CVE-2026-42337

5.3MEDIUM

Key Information:

Vendor

1panel-dev

Status
Maxkb
Vendor
CVE Published:
26 May 2026

What is CVE-2026-42337?

MaxKB, an open-source AI assistant for enterprise, contains a vulnerability in its OSS file service URL fetch API. Versions 2.8.0 and earlier are susceptible to a broken access control issue, where the endpoint utilizes the application_id from the URL path without appropriate validation of ownership. This flaw enables attackers to execute operations under the policies of other applications, potentially compromising sensitive data. The issue has been addressed and resolved in version 2.8.1.

Affected Version(s)

MaxKB < 2.8.1

References

https://github.com/1Panel-dev/MaxKB/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.