CVE-2026-77518

Deferred Deferred - Pending Action

Information Disclosure in MaxKB AI Assistant

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcp_tool_id in a workflow mcp-node so workflow debug uses the owner's MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-77518

Affected Vendors & Products

Vendor	Product	Version / Range
maxkb	maxkb	to 2.10.2-lts (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

In MaxKB versions 2.10.2-lts and earlier, a normal workspace user can exploit a flaw to access hidden tools by knowing another user's active MCP tool_id. The tool-detail route lacks proper authorization checks, allowing unauthorized access to tool details including sensitive MCP server configurations and headers.

Detection Guidance

Check MaxKB logs for unauthorized access to tool-detail routes or MCP tool configurations. Look for requests with foreign mcp_tool_id values in workflow debug logs. Verify if non-admin users can retrieve Tool.code containing MCP server details.

Impact Analysis

An attacker with workspace access could retrieve hidden tools and their configurations. If the attacker creates or edits a workflow, they might use the victim's MCP tool_id to execute actions without permission, potentially exposing sensitive data or misusing system resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of MCP server configurations might also breach data protection and security control mandates.

Mitigation Strategies

Upgrade to a patched version if available. Temporarily restrict access to tool-detail routes for non-admin users. Review and audit MCP tool configurations for unauthorized access. Monitor workflow debug logs for suspicious MCP tool usage.

Hi! I’m here to help you understand CVE-2026-77518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70