Arbitrary Command Execution in MaxKB AI Assistant Tool
CVE-2026-54149

8.8HIGH

Key Information:

Vendor

1panel-dev

Status
Maxkb
Vendor
CVE Published:
10 July 2026

What is CVE-2026-54149?

MaxKB, an open-source AI assistant for enterprises, suffers from a vulnerability that allows authenticated users to import malicious .tool files. These files can contain harmful commands that execute on the system through an AI Chat node, leveraging improper validation of transport types in the tool's import functionality. This flaw exists in versions prior to 2.10.0-lts and poses significant risks if exploited. Users are advised to upgrade to version 2.10.0-lts for enhanced security measures.

Affected Version(s)

MaxKB < 2.10.0-lts

References

https://github.com/1Panel-dev/MaxKB/security/advisories/G...
x_refsource_CONFIRM
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.0-lts
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.