CVE-2026-77518 MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...