CVE-2026-77521criticalCWE-250CWE-749CWE-78

CVE-2026-77521: critical vulnerability in 1Panel-dev MaxKB

MaxKB: Prompt-injectable agent can lead to command execution

Published · Updated

Follow this CVE+ Monitor MaxKB

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 10epss 1.0%
from disclosure to weapon24 days
Published on NVDSep 21
1st PoC+24d
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
1Panel-dev · MaxKB
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — 1Panel-dev MaxKB

In the same product, most dangerous first.

CVE-2026-6108MEDIUM1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionEPSS 1.5%CVE-2024-56137MEDIUMMaxKB RCE vulnerability in function libraryEPSS 0.8%CVE-2025-4546MEDIUM1Panel-dev MaxKB Knowledge Base Module csv injectionEPSS 0.7%CVE-2025-53928MEDIUMMaxKB has RCE in MCP callEPSS 0.5%CVE-2026-54149HIGHMaxKB MCP tool import validation bypass allows post-authentication remote code executionEPSS 0.5%CVE-2026-39420MEDIUMMaxKB: Sandbox escape via LD_PRELOAD bypassEPSS 0.5%