Executive brief
MaxKB is an open-source AI assistant for enterprise use. A user who knows another user's AI tool identifier can read that tool's configuration without authorization, including sensitive server settings and authentication headers. An attacker can also reference another user's tool in their own workflow to execute it with the original owner's permissions.
Technical details
The tool-detail API route lacks per-resource authorization checks, allowing an authenticated user to retrieve a known tool_id and expose Tool.code containing MCP server configuration. Additionally, workflow mcp-nodes accept foreign mcp_tool_id references without verifying the workflow owner's permission to use that tool, enabling privilege amplification during workflow debug execution. The vulnerability requires the attacker to be a legitimate workspace user who knows the target tool's ID.
Affected products
- 1Panel-dev MaxKB 2.10.2-lts and earlier
Timeline
- 2026-09-21: disclosed