CVE-2026-39417

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args — achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0.

• CWE-20
• CWE-78

• https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304Patch
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0Release Notes
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xjVendor Advisory

Published

Apr 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1
• CVE-2026-39412LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
• CVE-2026-39414MinIO is a high-performance object storage system. From RELE…6.5
• CVE-2026-39415Frappe Learning Management System (LMS) is a learning system…4.3
• CVE-2026-39416AIL framework is an open-source platform to collect, crawl, …6.1
• CVE-2026-39418MaxKB is an open-source AI assistant for enterprise. In vers…7.4
• CVE-2026-39419MaxKB is an open-source AI assistant for enterprise. In vers…3.1
• CVE-2026-3942Incorrect security UI in PictureInPicture in Google Chrome p…4.3
• CVE-2026-39420MaxKB is an open-source AI assistant for enterprise. In vers…7.4
• CVE-2026-39421MaxKB is an open-source AI assistant for enterprise. Version…7.4
• CVE-2026-39422MaxKB is an open-source AI assistant for enterprise. Version…5.4