Unauthorized Access Vulnerability in MaxKB AI Assistant by 1Panel

CVE-2026-44847

What is CVE-2026-44847?

The MaxKB AI assistant, utilized for enterprise tasks, is afflicted by a vulnerability that allows unauthorized access to its webhook trigger endpoint. Prior to version 2.9.0, the '/api/trigger/v1/webhook/{trigger_id}' endpoint is open to any user without authentication. Due to a flaw in the WebhookAuth class, which indiscriminately returns (None, {}), the Django REST Framework mistakenly recognizes this as successful authentication. This oversight means that any attacker who possesses a valid trigger ID can exploit the webhook triggers to execute potentially harmful tasks without authorization. The issue has been addressed in version 2.9.0, making it critical for users to update their systems to ensure security.

References