CVE-2026-54149: MaxKB AI Assistant RCE Vulnerability

CVE-2026-54149 Overview

CVE-2026-54149 is a command injection vulnerability in MaxKB, an open-source AI assistant for enterprise environments. The flaw resides in the tool import functionality at apps/tools/serializers/tool.py and the Model Context Protocol (MCP) referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py. Neither location consistently validates the MCP transport type. An authenticated user can import a .tool file containing stdio transport with malicious commands. Triggering that configuration through an AI Chat node causes MultiServerMCPClient to execute arbitrary system commands on the host. The issue is fixed in version 2.10.0-lts and maps to [CWE-78] OS Command Injection.

Critical Impact
Authenticated attackers can achieve arbitrary command execution on the MaxKB server, leading to full host compromise, data theft, and lateral movement.

Affected Products

MaxKB versions prior to 2.10.0-lts
MaxKB tool import subsystem (apps/tools/serializers/tool.py)
MaxKB MCP referencing pipeline (apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py)

Discovery Timeline

2026-07-10 - CVE-2026-54149 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-54149

Vulnerability Analysis

MaxKB integrates external tools through the Model Context Protocol (MCP). MCP supports multiple transports, including stdio, which spawns a local subprocess and communicates over standard input and output. The MaxKB tool importer accepts .tool definition files from authenticated users. The importer does not enforce an allow-list on the MCP transport type or validate the command payload. The MCP referencing logic invoked from the AI Chat node likewise trusts the stored configuration. When a chat node references the imported tool, MultiServerMCPClient instantiates the transport and executes the attacker-controlled command line under the MaxKB service account.

Root Cause

The root cause is missing input validation on tool definitions imported into MaxKB. The serializer at apps/tools/serializers/tool.py deserializes user-supplied tool metadata without restricting transport types, and the chat pipeline reuses that unvalidated configuration. Because stdio transport translates the command and args fields into a subprocess invocation, uncontrolled input flows directly into process creation, producing an OS command injection primitive.

Attack Vector

An attacker who holds valid MaxKB credentials uploads a crafted .tool file that declares stdio transport and sets the command and arguments to attacker-chosen values such as a reverse shell or arbitrary binary. The attacker then sends a chat message to an application that references the imported tool. MultiServerMCPClient launches the subprocess, executing the payload on the MaxKB host with the privileges of the MaxKB process. No user interaction beyond the attacker's own session is required, and the network attack vector applies because MaxKB is typically exposed over HTTP.

A sanitized code sample is not published by the vendor. Refer to the GitHub Security Advisory GHSA-4pr3-9xhm-98x5 for the maintainer's technical write-up.

Detection Methods for CVE-2026-54149

Indicators of Compromise

Unexpected .tool files uploaded to MaxKB with transport: stdio declarations in the tool JSON payload.
Child processes spawned by the MaxKB Python worker that are not part of the normal MCP tool inventory, especially shells such as sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated by processes parented to the MaxKB service to unknown external hosts.
New or modified entries in the MaxKB tool database referencing suspicious binaries, absolute paths, or shell metacharacters.

Detection Strategies

Audit MaxKB application logs for tool import events performed by non-administrative accounts and correlate with subsequent AI Chat node executions.
Enable endpoint process telemetry on the MaxKB host to alert on process ancestry where the MaxKB Python interpreter spawns interactive shells or scripting engines.
Inspect stored tool definitions in the MaxKB database and flag any records containing stdio transport with commands outside a defined allow-list.

Monitoring Recommendations

Forward MaxKB application, web server, and host process logs to a centralized SIEM for correlation and long-term retention.
Alert on file writes to MaxKB tool import directories originating from user-facing API endpoints.
Track authenticated session activity for accounts that both import tools and initiate chat conversations within a short time window.

How to Mitigate CVE-2026-54149

Immediate Actions Required

Upgrade MaxKB to version 2.10.0-lts or later using the release available at GitHub Release v2.10.0-lts.
Review all existing tool definitions and remove any entries that use stdio transport or reference untrusted commands.
Rotate credentials, API keys, and secrets accessible from the MaxKB host if compromise is suspected.
Restrict MaxKB administrative and tool import permissions to a minimal set of trusted users.

Patch Information

The MaxKB maintainers fixed CVE-2026-54149 in version 2.10.0-lts by enforcing consistent MCP transport type validation in both the tool import serializer and the chat pipeline. Full details are published in GitHub Security Advisory GHSA-4pr3-9xhm-98x5.

Workarounds

Place MaxKB behind an authenticating reverse proxy and limit access to trusted network segments until the patch is applied.
Run the MaxKB service as an unprivileged, sandboxed user with no shell and restricted filesystem write permissions.
Deploy MaxKB inside a container with a read-only root filesystem and egress firewall rules to reduce blast radius from arbitrary command execution.
Temporarily disable the tool import feature for non-administrator roles until upgrade is complete.

bash

# Configuration example: pin MaxKB to the fixed release in docker-compose
services:
  maxkb:
    image: 1panel/maxkb:v2.10.0-lts
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true