CVE-2026-77519: falha de média gravidade em 1Panel-dev MaxKB
MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
1Panel-dev · MaxKBCVEs relacionadas — 1Panel-dev MaxKB
No mesmo produto, das mais perigosas para as menos.
CVE-2026-6108MEDIUM1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionEPSS 1.5%CVE-2026-77521CRITICALMaxKB: Prompt-injectable agent can lead to command executionEPSS 1.0%CVE-2024-56137MEDIUMMaxKB RCE vulnerability in function libraryEPSS 0.8%CVE-2025-4546MEDIUM1Panel-dev MaxKB Knowledge Base Module csv injectionEPSS 0.7%CVE-2025-53928MEDIUMMaxKB has RCE in MCP callEPSS 0.5%CVE-2026-54149HIGHMaxKB MCP tool import validation bypass allows post-authentication remote code executionEPSS 0.5%