1Panel-dev MaxKB vulnerabilities

CVEs per yearBy the year they were published

1. 202511
2. 20251
3. 202635

Newest CVEs

• CVE-2026-79919

  MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

  1Panel-dev · MaxKB

  Medium6.3
• CVE-2026-79918

  MaxKB: Sandbox escape via unhooked fexecve

  1Panel-dev · MaxKB

  Medium6.3
• CVE-2026-77517

  MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base

  1Panel-dev · MaxKB

  Medium5.4
• CVE-2026-77521

  MaxKB: Prompt-injectable agent can lead to command execution

  1Panel-dev · MaxKB

  Critical10.0
• CVE-2026-77522

  MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

  1Panel-dev · MaxKB

  Medium4.3
• CVE-2026-79917

  MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

  1Panel-dev · MaxKB

  Medium6.5
• CVE-2026-77516

  MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

  1Panel-dev · MaxKB

  Medium5.4
• CVE-2026-77523

  MaxKB: Cross-workspace model parameter form write

  1Panel-dev · MaxKB

  High7.4
• CVE-2026-77525

  MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id

  1Panel-dev · MaxKB

  Medium4.2
• CVE-2026-77518

  MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

  1Panel-dev · MaxKB

  Medium5.0