CVE-2026-39417 MaxKB: RCE via MCP stdio command injection in workflow engine
Attackers can achieve remote code execution in MaxKB by injecting commands into the MCP workflow engine via crafted JSON payloads.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-39417?
CVE-2026-39417 is a medium-severity command injection vulnerability in 1Panel-dev MaxKB, published on 14 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args — achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0.
Which versions are affected by CVE-2026-39417?
It affects 1 product.
Products include Maxkb Maxkb.
How do I fix CVE-2026-39417?
No fix has been published for CVE-2026-39417 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-39417 being exploited?
There is no known exploitation of CVE-2026-39417 in the wild and no public exploit code.
Other vulnerabilities in 1Panel-dev MaxKB
- CVE-2025-66419 MaxKB vulnerable to privilege escalation through sandbox bypass
- CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass
- CVE-2025-64511 MaxKB has SSRF in sandbox
- CVE-2026-39422 MaxKB has Stored XSS via ChatHeadersMiddleware
- CVE-2026-39423 Stored XSS via Eval Injection in EchartsRander Component
Sources
Also known as GHSA-pw52-326g-r5xj.