CVE-2026-79916: fallo crítico en 1Panel-dev MaxKB
MaxKB AWS Bedrock model credential injection leads to remote code execution
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.4%
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root. This vulnerability is fixed in 2.10.5-lts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Productos afectados
1Panel-dev · MaxKBCVEs relacionadas — 1Panel-dev MaxKB
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-6108MEDIUM1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionEPSS 1.5%CVE-2026-77521CRITICALMaxKB: Prompt-injectable agent can lead to command executionEPSS 1.0%CVE-2024-56137MEDIUMMaxKB RCE vulnerability in function libraryEPSS 0.8%CVE-2025-4546MEDIUM1Panel-dev MaxKB Knowledge Base Module csv injectionEPSS 0.7%CVE-2025-53928MEDIUMMaxKB has RCE in MCP callEPSS 0.5%CVE-2026-54149HIGHMaxKB MCP tool import validation bypass allows post-authentication remote code executionEPSS 0.5%