CVE-2026-44847

🗓️ 26 May 2026 20:16:46Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 29 Views🌐 WEB

CVE-2026-44847: MaxKB webhook trigger authentication bypass enables unauthenticated trigger calls with a valid trigger identifier; fixed in 2.9.0.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-44847	26 May 202620:16	–	attackerkb
Circl	CVE-2026-44847	27 May 202606:00	–	circl
CNNVD	MaxKB 访问控制错误漏洞	26 May 202600:00	–	cnnvd
Cvelist	CVE-2026-44847 MaxKB: Webhook Trigger Authentication Bypass	26 May 202620:16	–	cvelist
EUVD	EUVD-2026-31987	26 May 202620:16	–	euvd
NVD	CVE-2026-44847	26 May 202621:16	–	nvd
Positive Technologies	PT-2026-43404	26 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-44847	1 Jun 202622:03	–	redhatcve
Vulnrichment	CVE-2026-44847 MaxKB: Webhook Trigger Authentication Bypass	26 May 202620:16	–	vulnrichment

Vulners

Node

1panel-dev maxkbRange<2.9.0

[
  {
    "vendor": "1Panel-dev",
    "product": "MaxKB",
    "versions": [
      {
        "version": "< 2.9.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/1Panel-dev/MaxKB/security/advisories/GHSA-r3j3-j58q-rjpp
github	www.github.com/1Panel-dev/MaxKB/issues/5213

Parameter	Position	Path	Description	CWE
trigger_id	path	/api/trigger/v1/webhook/{trigger_id}	Webhook trigger endpoint is accessible without authentication, allowing unauthenticated users with a valid trigger_id to invoke bound tasks.	CWE-287, CWE-306

17 Jun 2026 10:51Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00271

SSVC