CVE-2026-79918: Protection Mechanism Failure

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LDPRELOAD sandbox hooks execve, execvpe, and execveat to prevent subprocess creation but does not hook fexecve. An authenticated attacker able to execute tool code can call fexecve to start a proces...

CVE-2026-79916: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-77525: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationid but load records using global chatid and chatrecordid values without confirming that the chat belongs to the authorized application. A normal user in the...

CVE-2026-77521: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...

CVE-2026-77520: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

CVE-2026-77517: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledgeid in the request path, then query the target Document by documentid or Paragraph by paragraphid without confirming that the object belongs to...

PT-2026-96258

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.3-lts Description An issue exists in the model parameter form route where the system authorizes the workspace path but the ModelSerializer.ModelParams function loads and saves a model using only the id without...

CVE-2026-77523: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspaceid in the query. An authenticated user with model rea...

PT-2026-96252

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.0.0 through 2.9.2 Description A workspace member with the lowest role who has been denied access to a tool via WorkspaceUserResourcePermission can still bind the tool identifier using tool ids, skill tool ids, or mcp tool ids...

CVE-2026-77518: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

PT-2026-96253

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.0.0 through 2.10.2-lts Description An authorization flaw exists in the document and paragraph operation routes. The system validates the knowledge id in the request path but fails to verify if the target Document, identified b...

PT-2026-96264

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description Function-library code running under the LD PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback. This allows the dlopen call-stack heuristic to identify a Python...

PT-2026-96263

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description The ToolExecutor LD PRELOAD sandbox fails to hook the fexecve function, although it hooks execve, execvpe, and execveat to prevent subprocess creation. An authenticated attacker with the ability t...

PT-2026-96259

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description Management chat-record routes authorize the path application id but load records using global chat id and chat record id values without verifying if the chat belongs to the authorized application...

PT-2026-96261

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Authenticated workspace members can inject control characters into the AWS Bedrock access key id and secret access key fields. These values are processed by the update aws credentials function and...

PT-2026-96262

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.7.0 through 2.10.4-lts Description An issue exists where the system verifies the existence of a conversation but fails to confirm if it belongs to the authenticated chat user id or the application associated with the caller's...

PT-2026-96257

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Assistants utilizing a tool, MCP tool, skill, or sub-application use the SandboxShellBackend, which exposes an execute shell tool. Because the execute function is omitted from the interrupt on...

CVE-2026-77516: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

CVE-2026-77519: Insufficient Session Expiration

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

CVE-2026-79919: Protection Mechanism Failure

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...