Executive brief
MaxKB is an open-source AI assistant platform that integrates with AWS Bedrock for AI model access. Authenticated users can inject control characters into AWS credential fields, allowing attackers to create malicious AWS profiles that execute arbitrary commands as root. This bypasses normal security controls and enables complete system compromise.
Technical details
The vulnerability exists in the AWS credential management component where unsanitized user input is written to /root/.aws/credentials without validation. Authenticated workspace members can inject newlines and control characters to append a credential_process directive, which botocore will execute during subsequent model validation requests. The attack requires authentication and workspace membership but grants root-level command execution.
Affected products
- 1Panel MaxKB before 2.10.5-lts
Timeline
- 2026-09-21: disclosed
- 2026-07-15: patched: Fix merged in v2.10.5-lts