Product by 1Panel-dev

    1Panel-dev MaxKB

    47 known vulnerabilities in 1Panel-dev MaxKB (1Panel-dev), 0 of them actively exploited (CISA KEV).

    Key figures

    47

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in 1Panel-dev MaxKB (1Panel-dev)
    CriticalCVE-2026-77521

    MaxKB: Prompt-injectable agent can lead to command execution

    		10.0
    MediumCVE-2026-6108

    1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection

    		6.3
    CriticalCVE-2026-79916

    MaxKB AWS Bedrock model credential injection leads to remote code execution

    		9.1
    HighCVE-2026-54149

    MaxKB MCP tool import validation bypass allows post-authentication remote code execution

    		8.8
    MediumCVE-2026-79919

    1Panel-dev MaxKB: Protection Mechanism Failure

    		6.3
    HighCVE-2024-56137

    MaxKB RCE vulnerability in function library

    also in 1 other product

    		6.8
    HighCVE-2026-77523

    MaxKB: Cross-workspace model parameter form write

    		7.4
    HighCVE-2026-39420

    MaxKB: Sandbox escape via LD_PRELOAD bypass

    also in 1 other product

    		7.4
    HighCVE-2025-48950

    MaxKB Python Sandbox Bypass in Function Library

    also in 1 other product

    		8.8
    MediumCVE-2026-79918

    MaxKB: Sandbox escape via unhooked fexecve

    		6.3
    HighCVE-2025-66446

    MaxKB has a Python sandbox LD_PRELOAD bypass

    also in 1 other product

    		8.8
    MediumCVE-2026-79917

    1Panel-dev MaxKB: Authorization Bypass Through User-Controlled Key

    		6.5
    CriticalCVE-2025-66419

    MaxKB vulnerable to privilege escalation through sandbox bypass

    also in 1 other product

    		8.8
    HighCVE-2026-44847

    MaxKB: Webhook Trigger Authentication Bypass

    		7.5
    HighCVE-2025-4546

    1Panel-dev MaxKB Knowledge Base Module csv injection

    also in 1 other product

    		4.7
    MediumCVE-2026-77516

    MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

    		5.4
    MediumCVE-2026-77519

    MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

    		5.4
    MediumCVE-2026-77520

    1Panel-dev MaxKB: Missing Authorization

    		5.4
    MediumCVE-2026-77517

    1Panel-dev MaxKB: Authorization Bypass Through User-Controlled Key

    		5.4
    HighCVE-2026-39421

    MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect

    also in 1 other product

    		7.4
    MediumCVE-2026-77518

    MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

    		5.0
    MediumCVE-2026-64870

    MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

    		—
    MediumCVE-2026-56779

    MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

    		6.4
    HighCVE-2026-39418

    MaxKB: SSRF via sandbox network hook bypass

    also in 1 other product

    		7.4
    MediumCVE-2026-77522

    1Panel-dev MaxKB: Server-Side Request Forgery (SSRF)

    		4.3

    All vulnerabilities in search

    All products by 1Panel-dev