1Panel-dev MaxKB up to 2.10.2-lts MCP Endpoint /chat/api/mcp improper authentication

Summaryinfo

A vulnerability classified as critical was found in 1Panel-dev MaxKB up to 2.10.2-lts. This vulnerability affects unknown code of the file /chat/api/mcp of the component MCP Endpoint. Executing a manipulation can lead to improper authentication. This vulnerability appears as CVE-2026-77519. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in 1Panel-dev MaxKB up to 2.10.2-lts. This vulnerability affects an unknown function of the file /chat/api/mcp of the component MCP Endpoint. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-77519 since 08/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• 1Panel-dev

Name

• MaxKB

Version

• 2.10.2-lts

Website

• Product: https://github.com/1Panel-dev/MaxKB/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion