CVE-2026-39417

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39417", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T00:23:30.595Z", "datePublished": "2026-04-14T00:03:16.020Z", "dateUpdated": "2026-04-14T13:34:07.454Z"}, "containers": {"cna": {"title": "MaxKB: RCE via MCP stdio command injection in workflow engine", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xj"}, {"name": "https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304", "tags": ["x_refsource_MISC"], "url": "https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304"}, {"name": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0"}], "affected": [{"vendor": "1Panel-dev", "product": "MaxKB", "versions": [{"version": "< 2.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T00:03:16.020Z"}, "descriptions": [{"lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args \u2014 achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0."}], "source": {"advisory": "GHSA-pw52-326g-r5xj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T13:33:54.884442Z", "id": "CVE-2026-39417", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:34:07.454Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39417", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T13:33:54.884442Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:34:00.626Z"}}], "cna": {"title": "MaxKB: RCE via MCP stdio command injection in workflow engine", "source": {"advisory": "GHSA-pw52-326g-r5xj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "1Panel-dev", "product": "MaxKB", "versions": [{"status": "affected", "version": "< 2.8.0"}]}], "references": [{"url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xj", "name": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304", "name": "https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0", "name": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args \u2014 achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T00:03:16.020Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39417", "state": "PUBLISHED", "dateUpdated": "2026-04-14T13:34:07.454Z", "dateReserved": "2026-04-07T00:23:30.595Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T00:03:16.020Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MaxKB", "vendor": "1Panel-dev", "versions": [{"status": "affected", "version": "< 2.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*", "matchCriteriaId": "8BB376B6-4E9C-4801-9D33-5BF858C857D2", "versionEndExcluding": "2.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args \u2014 achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0."}, {"lang": "es", "value": "MaxKB es un asistente de IA de c\u00f3digo abierto para empresas. Las versiones 2.7.1 e inferiores contienen una soluci\u00f3n incompleta para CVE-2025-53928, donde una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo a\u00fan existe en el nodo MCP del motor de flujo de trabajo. MaxKB solo restringe la ruta de c\u00f3digo de referencia (cargando la configuraci\u00f3n de MCP desde la base de datos). La rama else, responsable de cargar mcp_servers directamente desde JSON proporcionado por el usuario, permanece completamente sin parchear. Dado que mcp_source es un campo opcional (required=False), un atacante puede simplemente omitirlo o establecerlo en cualquier valor no referencial para eludir la soluci\u00f3n. Al llamar directamente a la API de creaci\u00f3n de flujo de trabajo con una carga \u00fatil JSON manipulada, un atacante puede inyectar una configuraci\u00f3n completa del nodo MCP con transporte stdio, comando arbitrario y argumentos - logrando RCE cuando el flujo de trabajo se activa a trav\u00e9s del chat. Este problema ha sido solucionado en la versi\u00f3n 2.8.0."}], "id": "CVE-2026-39417", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39417", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T13:33:54.884442Z", "version": "2.0.3"}}]}, "published": "2026-04-14T00:16:07.193", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/1Panel-dev/MaxKB/commit/50e96002ee5dca34c68d3d9333b64ea358c92304"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-pw52-326g-r5xj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.0)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 86.0, "source": "matching"}]}, "original": {"product": "MaxKB", "source": "cna", "vendor": "1Panel-dev"}, "product": "maxkb", "vendor": "1panel"}], "analysis": {"en": {"generated_at": "2026-04-14T01:25:27.522479+00:00", "value": {"mitigation_remediation": ["Upgrade MaxKB to version 2.8.0 or later", "Limit exposure of the workflow creation API to authenticated users only", "Monitor workflow activity logs for anomalous command injection patterns"], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is MaxKB, an open\u2011source AI assistant developed by 1Panel\u2011dev. Version 2.7.1 and all earlier releases are vulnerable. The issue is present in the MCP node of the workflow engine; later releases, such as 2.8.0, incorporate the fix.", "description_and_impact": "The vulnerability allows an attacker to inject arbitrary command payloads into the MCP node configuration by crafting a JSON payload when creating a workflow. This leads to remote code execution on the MaxKB server when the workflow is triggered, potentially compromising confidentiality, integrity, and availability. The flaw resides in an unpatched else branch that loads mcp_servers from user\u2011supplied data, an instance of OS Command Injection (CWE\u201178) and Improper Input Validation (CWE\u201120).", "risk_and_exploitability": "The CVSS score is 4.6, which classifies the risk as medium. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through the workflow creation API, so the attacker would need legitimate API access or the ability to inject the crafted JSON into the chat interface. Successful exploitation results in full code execution on the host, posing a severe threat to the entire system."}}}}, "created": "2026-04-14T16:16:37.638935+00:00", "updated": "2026-04-14T16:31:34.312871+00:00", "vendors": ["1panel", "1panel$PRODUCT$maxkb"]}