Executive brief
MaxKB, an open-source AI assistant platform, contains a security flaw that allows authenticated users to execute unauthorized commands on the underlying server. By importing a specially crafted tool file, an attacker can bypass security checks and force the system to run malicious code. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of business operations.
Technical details
A command injection vulnerability exists in MaxKB due to improper validation of Model Context Protocol (MCP) transport types during tool importation and chat pipeline execution. While MaxKB is designed to only support 'sse' and 'streamable_http' transports, the 'Import.import_' function in 'apps/tools/serializers/tool.py' and the referencing mode in 'base_chat_step.py' fail to call 'validate_mcp_transport'. An authenticated attacker can import a .tool file containing a 'stdio' transport configuration with arbitrary system commands. When this tool is triggered via an AI Chat node, the 'MultiServerMCPClient' processes the configuration and executes the commands via 'subprocess.Popen'. This issue is resolved in version 2.10.0-lts.
Affected products
- 1Panel-dev MaxKB < 2.10.0-lts
Timeline
- 2026-05-30: disclosed: Vulnerability discovered
- 2026-06-04: patched: Version 2.10.0-lts released
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-10: advisory: NVD published CVE-2026-54149