Executive brief
MaxKB is an open-source AI assistant platform for enterprises. The /chat/api/mcp endpoint accepts expired application API keys that the standard chat API correctly rejects, allowing an attacker with a formerly valid key to invoke tools and create permanent chat records even after the key has expired. This bypasses intended access controls on published applications.
Technical details
The vulnerability is an authentication bypass in the MCP (Model Context Protocol) endpoint caused by inconsistent expiration checking. While the standard chat API validates is_permanent and expire_time flags before granting access, the /chat/api/mcp endpoint only checks the API key's secret and is_active status. An attacker with a non-permanent application API key that has passed its expiration time can still initialize the MCP endpoint, list tool metadata, invoke tool execution, and create durable application_chat records—all actions denied by the standard chat route.
Affected products
- 1Panel-dev MaxKB 2.10.2-lts and earlier
Timeline
- 2026-09-21: disclosed
- 2026-09-02: advisory: GitHub security advisory GHSA-r6g6-69fh-c39q published