Executive brief
MaxKB, an open-source knowledge base and AI application platform, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands on the host server. By manipulating the configuration of a Model Context Protocol (MCP) node within an application workflow, an attacker can bypass security checks and run arbitrary code. This could lead to a complete takeover of the server, unauthorized access to sensitive data, or disruption of services.
Technical details
An OS command injection vulnerability exists in MaxKB up to version 2.6.1 within the Model Context Protocol (MCP) node implementation. The root cause is a validation bypass: while the application attempts to whitelist safe transport types (sse and streamable_http), this check is only performed on the tool-listing API endpoint and is omitted during the application edit and execution phases. An authenticated attacker can submit a crafted JSON configuration via the /edit endpoint, specifying a 'stdio' transport with arbitrary shell commands. When the workflow is executed via the BaseMcpNode.execute() function, the unsanitized configuration is passed to the MultiServerMCPClient, which spawns the attacker-specified process. A fix has been released by the vendor.
Affected products
- 1Panel-dev MaxKB up to 2.6.1
Timeline
- 2026-03-18: disclosed: Public disclosure of the vulnerability and exploit details on GitHub.
- 2026-04-12: advisory: CVE-2026-6108 published.