CVE-2026-79916

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root. This vulnerability is fixed in 2.10.5-lts.

• CWE-78

• https://github.com/1Panel-dev/MaxKB/commit/a1e413d196004421ab0953ee0baa13d4ca0fe3c4
• https://github.com/1Panel-dev/MaxKB/pull/6418
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.5-lts
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-2324-7xjr-9qxg

Published

Sep 21, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79909Acrobat Reader is affected by a Use After Free vulnerability…7.8
• CVE-2026-7991Use after free in UI in Google Chrome prior to 148.0.7778.96…8.8
• CVE-2026-79910Acrobat Reader is affected by an out-of-bounds read vulnerab…5.5
• CVE-2026-79911A security vulnerability has been detected in TOTOLINK N600R…10
• CVE-2026-79912A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_…8.3
• CVE-2026-79913Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-79917MaxKB is an open-source AI assistant for enterprise. In 2.7.…6.5
• CVE-2026-79918MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-79919MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-7992Insufficient validation of untrusted input in UI in Google C…8.8
• CVE-2026-79920Ajenti is a Linux & BSD modular server admin panel. Prior to…9.9
• CVE-2026-79921amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0,…8.9