1Panel-dev MaxKB up to 2.10.2-lts Tool Detail improper authorization

Summaryinfo

A vulnerability identified as problematic has been detected in 1Panel-dev MaxKB up to 2.10.2-lts. This impacts an unknown function of the component Tool Detail. The manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-77518. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in 1Panel-dev MaxKB up to 2.10.2-lts and classified as problematic. This issue affects some unknown functionality of the component Tool Detail. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcp_tool_id in a workflow mcp-node so workflow debug uses the owner's MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-77518 since 08/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/21/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• 1Panel-dev

Name

• MaxKB

Version

• 2.10.2-lts

Website

• Product: https://github.com/1Panel-dev/MaxKB/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion