Skip to content
OpenAdvisories

Product · 1Panel-dev

MaxKB

47 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-77521 Public exploit

    MaxKB: Prompt-injectable agent can lead to command execution

    MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on…

    1Panel-dev MaxKB
  • Critical 9.1
    CVE-2026-79916

    MaxKB AWS Bedrock model credential injection leads to remote code execution

    MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials w…

    1Panel-dev MaxKB