Executive brief
MaxKB, an open-source AI assistant for enterprises, contains a security flaw in how it handles webhook triggers. This vulnerability allows an unauthenticated attacker to remotely trigger automated tasks, such as AI workflows or custom scripts, without providing any credentials. Depending on how the assistant is configured, this could lead to unauthorized data access, exhaustion of AI API credits, or the execution of malicious code on the server.
Technical details
The vulnerability exists in the MaxKB webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}). The 'WebhookAuth' class incorrectly returns (None, {}) during authentication, which the Django REST Framework interprets as a successful authentication signal. Furthermore, while the application supports token-based verification, it is only enforced if a token is explicitly defined in the trigger settings; the backend does not mandate token creation for EVENT-type triggers. An attacker with knowledge of a valid trigger ID can invoke the webhook to execute associated tasks, including custom Python code via 'ToolExecutor.exec_code()', potentially leading to remote code execution if the sandbox is disabled. This issue is resolved in version 2.9.0 by enforcing token requirements and correcting the authentication return values.
Affected products
- 1Panel-dev MaxKB < 2.9.0
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD