CVE-2026-77519 in MaxKB
Summary
by MITRE • 09/21/2026
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in MaxKB versions 2.10.2-lts and earlier represents a critical authentication bypass within the Model Context Protocol (MCP) endpoint, specifically affecting the /chat/api/mcp path. This flaw stems from an inconsistent implementation of credential validation logic compared to the standard chat API endpoints. While the primary interface correctly enforces comprehensive checks on application keys—including verifying that they are permanent and have not exceeded their expiration time—the MCP endpoint performs a significantly weaker lookup operation. It relies solely on the presence of a valid secret key and its active status flag, completely ignoring temporal constraints such as expire_time or permanence requirements. This discrepancy creates a security gap where credentials that should be considered invalid due to expiration can still successfully authenticate against this specific API route.
The operational impact of this vulnerability is severe because it allows attackers to maintain access using expired credentials. In typical enterprise deployments, application keys are often rotated or revoked upon expiration as part of standard key management practices. However, an attacker possessing a previously valid non-permanent key that has since passed its expire_time but remains marked as active in the database can bypass these controls. By targeting the /chat/api/mcp endpoint, the adversary can successfully initialize sessions with published applications. This unauthorized access enables the enumeration of tool metadata associated with those applications, providing valuable intelligence for further exploitation. Furthermore, the attacker is able to invoke tools via the call interface and create durable application_chat records along with corresponding chat history entries. These actions persist in the system state despite being performed under invalid authentication conditions, leading to potential data integrity issues and unauthorized resource consumption.
From a technical perspective, this issue aligns closely with CWE-287 Improper Authentication, as the system fails to adequately verify credentials during access control decisions. The specific mechanism of bypassing expiration checks also relates to CWE-613 Insufficient Session Expiration. Additionally, within the MITRE ATT&CK framework, this behavior facilitates Initial Access and Persistence tactics by allowing an actor to leverage stale or expired tokens that were not properly invalidated across all service endpoints. The lack of a fixed version as of the review period exacerbates the risk, leaving organizations vulnerable until a patch is released. Mitigation strategies should focus on implementing strict input validation and ensuring consistent authentication logic across all API routes. Administrators are advised to audit their application keys for any that remain active past their expiration dates and manually deactivate them if possible. Until an official fix is available, restricting network access to the MCP endpoint or applying web application firewall rules to block requests from expired key patterns may provide temporary relief against exploitation attempts.