CVE-2026-44847
Deferred Deferred - Pending Action
Unauthenticated Webhook Execution in MaxKB

Publication date: 2026-05-26

Last updated on: 2026-05-26

Assigner: GitHub, Inc.

Description
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication. The WebhookAuth class unconditionally returns (None, {}), which Django REST Framework interprets as successful authentication. Combined with optional per-trigger token verification and no backend enforcement of token requirements, any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute their bound tasks. This vulnerability is fixed in 2.9.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-26
Last Modified
2026-05-26
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-44847
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
maxkb maxkb 2.9.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in MaxKB, an open-source AI assistant for enterprise, in versions prior to 2.9.0. The webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication because the WebhookAuth class always returns (None, {}), which Django REST Framework treats as successful authentication. This means that any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers and execute their bound tasks without proper authorization.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute tasks bound to webhook triggers by simply knowing a valid trigger ID. This can lead to unauthorized actions being performed within the MaxKB system, potentially compromising the integrity of operations or causing unintended behavior. The CVSS score indicates a high impact on integrity but no impact on confidentiality or availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade MaxKB to version 2.9.0 or later, where the issue is fixed.

Until the upgrade is applied, restrict access to the webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) to trusted users or networks to prevent unauthenticated invocation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart