Quick answers
- Is CVE-2026-77519 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77519 being exploited in the wild.
- How severe is CVE-2026-77519?
- Medium severity, with a CVSS score of 5.4, published 21 September 2026.
- Which products and versions are affected?
- 1Panel-dev MaxKB 2.10.2-lts and earlier.
- Is there a fix for CVE-2026-77519?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77519 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-77519?
- Check whether you run 1Panel-dev MaxKB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass in the MCP (Model Context Protocol) endpoint caused by inconsistent expiration checking. While the standard chat API validates is_permanent and expire_time flags before granting access, the /chat/api/mcp endpoint only checks the API key's secret and is_active status. An attacker with a non-permanent application API key that has passed its expiration time can still initialize the MCP endpoint, list tool metadata, invoke tool execution, and create durable application_chat records—all actions denied by the standard chat route.
Affected products
- 1Panel-dev MaxKB 2.10.2-lts and earlier
Timeline
- 2026-09-21: disclosed
- 2026-09-02: advisory: GitHub security advisory GHSA-r6g6-69fh-c39q published