# 1Panel-dev MaxKB vulnerabilities

Source: https://junglewise.ai/threats/technologies/maxkb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/maxkb.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 17 vulnerabilities in 1Panel-dev MaxKB: 0 in the last 7 days and 8 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77525, was published on 21 September 2026. Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 1.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 8
- All time: 17 (1 critical, 0 exploited in the wild)

## About 1Panel-dev MaxKB

MaxKB is an open-source knowledge base question and answering system based on Large Language Models.

## Latest 1Panel-dev MaxKB vulnerabilities

- [CVE-2026-77525: MaxKB chat-record routes authorization bypass in management API](https://junglewise.ai/threats/cve-2026-77525-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 4.2, published 21 Sep 2026)
- [CVE-2026-77523: MaxKB cross-workspace model parameter form write](https://junglewise.ai/threats/cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (high, CVSS 7.4, published 21 Sep 2026)
- [CVE-2026-77522: MaxKB knowledge web-document crawler server-side request forgery](https://junglewise.ai/threats/cve-2026-77522-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (medium, CVSS 4.3, published 21 Sep 2026)
- [CVE-2026-77521: MaxKB command execution in SandboxShellBackend](https://junglewise.ai/threats/cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to) (critical, CVSS 10, published 21 Sep 2026)
- [CVE-2026-77520: MaxKB authorization bypass in application discovery and invocation](https://junglewise.ai/threats/cve-2026-77520-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5.4, published 21 Sep 2026)
- [CVE-2026-77519: MaxKB expired application API keys remain usable on MCP endpoint](https://junglewise.ai/threats/cve-2026-77519-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5.4, published 21 Sep 2026)
- [CVE-2026-77518: MaxKB authorization bypass exposes MCP tool configuration](https://junglewise.ai/threats/cve-2026-77518-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5, published 21 Sep 2026)
- [CVE-2026-77517: MaxKB authorization bypass in document and paragraph routes](https://junglewise.ai/threats/cve-2026-77517-maxkb-is-an-open-source-ai-assistant-for-enterprise-from-version) (medium, CVSS 5.4, published 21 Sep 2026)
- [CVE-2026-64870: 1Panel-dev MaxKB SSRF in UpdateStoreTool](https://junglewise.ai/threats/cve-2026-64870-1panel-dev-maxkb-ssrf-in-updatestoretool) (info, CVSS 5.3, published 30 Jul 2026)
- [CVE-2026-54149: 1Panel-dev MaxKB command injection in MCP tool import](https://junglewise.ai/threats/cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import) (high, CVSS 8.8, published 10 Jul 2026)
- [CVE-2026-56779: 1Panel-dev MaxKB SSRF in ToolSerializer endpoints](https://junglewise.ai/threats/cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints) (medium, CVSS 6.4, published 25 Jun 2026)
- [CVE-2026-45413: MaxKB unsalted MD5 password hashing](https://junglewise.ai/threats/cve-2026-45413-maxkb-unsalted-md5-password-hashing) (info, CVSS 6.9, published 26 May 2026)
- [CVE-2026-45412: 1Panel-dev MaxKB SSRF in workflow template import](https://junglewise.ai/threats/cve-2026-45412-1panel-dev-maxkb-ssrf-in-workflow-template-import) (info, CVSS 6.3, published 26 May 2026)
- [CVE-2026-44847: MaxKB authentication bypass in webhook trigger endpoint](https://junglewise.ai/threats/cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint) (high, CVSS 7.5, published 26 May 2026)
- [CVE-2026-42337: 1Panel-dev MaxKB broken access control in OSS URL fetch API](https://junglewise.ai/threats/cve-2026-42337-1panel-dev-maxkb-broken-access-control-in-oss-url-fetch-api) (info, CVSS 5.3, published 26 May 2026)
- [CVE-2026-42336: 1Panel-dev MaxKB SSRF bypass in OSS file service](https://junglewise.ai/threats/cve-2026-42336-1panel-dev-maxkb-ssrf-bypass-in-oss-file-service) (info, CVSS 5.1, published 26 May 2026)
- [CVE-2026-42335: 1Panel-dev MaxKB SSRF in OSS file service URL fetch](https://junglewise.ai/threats/cve-2026-42335-1panel-dev-maxkb-ssrf-in-oss-file-service-url-fetch) (info, CVSS 6.3, published 26 May 2026)

## Most severe 1Panel-dev MaxKB vulnerabilities

- [CVE-2026-77521: MaxKB command execution in SandboxShellBackend](https://junglewise.ai/threats/cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to) (critical, CVSS 10, published 21 Sep 2026)
- [CVE-2026-54149: 1Panel-dev MaxKB command injection in MCP tool import](https://junglewise.ai/threats/cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import) (high, CVSS 8.8, published 10 Jul 2026)
- [CVE-2026-44847: MaxKB authentication bypass in webhook trigger endpoint](https://junglewise.ai/threats/cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint) (high, CVSS 7.5, published 26 May 2026)
- [CVE-2026-77523: MaxKB cross-workspace model parameter form write](https://junglewise.ai/threats/cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (high, CVSS 7.4, published 21 Sep 2026)
- [CVE-2026-56779: 1Panel-dev MaxKB SSRF in ToolSerializer endpoints](https://junglewise.ai/threats/cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints) (medium, CVSS 6.4, published 25 Jun 2026)
- [CVE-2026-77519: MaxKB expired application API keys remain usable on MCP endpoint](https://junglewise.ai/threats/cve-2026-77519-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5.4, published 21 Sep 2026)
- [CVE-2026-77520: MaxKB authorization bypass in application discovery and invocation](https://junglewise.ai/threats/cve-2026-77520-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5.4, published 21 Sep 2026)
- [CVE-2026-77517: MaxKB authorization bypass in document and paragraph routes](https://junglewise.ai/threats/cve-2026-77517-maxkb-is-an-open-source-ai-assistant-for-enterprise-from-version) (medium, CVSS 5.4, published 21 Sep 2026)
- [CVE-2026-77518: MaxKB authorization bypass exposes MCP tool configuration](https://junglewise.ai/threats/cve-2026-77518-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5, published 21 Sep 2026)
- [CVE-2026-77522: MaxKB knowledge web-document crawler server-side request forgery](https://junglewise.ai/threats/cve-2026-77522-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (medium, CVSS 4.3, published 21 Sep 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 8 | 1 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other 1Panel-dev technologies

- [1Panel-dev CordysCRM](https://junglewise.ai/threats/technologies/cordyscrm): 16 vulnerabilities
- [1Panel-dev 1Panel](https://junglewise.ai/threats/technologies/1panel): 7 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "1Panel-dev MaxKB vulnerabilities", https://junglewise.ai/threats/technologies/maxkb, 11 November 2026.