CVE-2026-77516: MaxKB AI Assistant Auth Bypass Vulnerability

CVE-2026-77516 Overview

CVE-2026-77516 is an authorization bypass vulnerability in MaxKB, an open-source AI assistant for enterprise deployments. The flaw affects versions 2.0.0 through 2.9.2 and allows a low-privileged workspace member to invoke tools that were explicitly denied to them by WorkspaceUserResourcePermission. Attackers bind denied tool identifiers through tool_ids, skill_tool_ids, or mcp_tool_ids and execute them via the agent or workflow dispatch path. Because tool execution decrypts server-side init_params, the caller receives credentials embedded in the denied tool. The vulnerability is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Low-role workspace members can execute denied tools and harvest embedded credentials, breaking the workspace permission boundary.

Affected Products

MaxKB version 2.0.0 through 2.9.2
MaxKB agent dispatch path
MaxKB workflow dispatch path

Discovery Timeline

2026-09-21 - CVE-2026-77516 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-77516

Vulnerability Analysis

MaxKB enforces per-tool access using WorkspaceUserResourcePermission, which the dedicated tool routes correctly consult before invocation. The agent and workflow dispatch paths, however, do not reapply this per-tool grant check. A workspace member who has been denied access to a specific tool can still reference that tool's identifier when constructing an agent or workflow request. The dispatch handler accepts the identifier through fields such as tool_ids, skill_tool_ids, or mcp_tool_ids and proceeds to execute the bound tool. During execution, MaxKB decrypts the tool's server-side init_params, which commonly contain API keys, service credentials, or other secrets. Those decrypted values are returned in the tool's execution context, exposing them to the caller. This turns a denied tool binding into a credential disclosure and unauthorized execution primitive within the workspace.

Root Cause

The root cause is inconsistent enforcement of WorkspaceUserResourcePermission across execution surfaces. Dedicated tool routes check the per-tool grant, while the dispatch handlers used by agents and workflows do not. This is a classic Insecure Direct Object Reference pattern in which the caller supplies a resource identifier that the server trusts without re-authorizing.

Attack Vector

Exploitation requires an authenticated workspace member with the lowest role. The attacker crafts an agent or workflow invocation that references a tool identifier they are not permitted to access. The dispatch path binds and executes the tool, decrypts its stored init_params, and surfaces the results, including embedded credentials, back to the caller. No user interaction beyond authenticated API access is required.

See the GitHub Security Advisory GHSA-383v-fx78-pphm for the vendor's technical description.

Detection Methods for CVE-2026-77516

Indicators of Compromise

Agent or workflow dispatch requests from low-role workspace users that reference tool_ids, skill_tool_ids, or mcp_tool_ids values the user has no direct route access to.
Tool execution log entries that show successful invocation by users whose WorkspaceUserResourcePermission denies the tool.
Unexpected outbound API calls originating from MaxKB using credentials stored in a denied tool's init_params.

Detection Strategies

Correlate MaxKB permission records with dispatch execution logs to flag executions that violate the per-tool grant.
Baseline each workspace member's typical tool usage and alert on first-time invocations of sensitive tools.
Alert on any workflow or agent definition that binds a tool the creator lacks direct permission to invoke.

Monitoring Recommendations

Forward MaxKB application and dispatch logs to a centralized SIEM for correlation with identity data.
Monitor for spikes in tool invocations tied to low-role accounts, especially against tools holding third-party credentials.
Track outbound calls from MaxKB service accounts to detect credential reuse against external systems.

How to Mitigate CVE-2026-77516

Immediate Actions Required

Restrict access to MaxKB versions 2.0.0 through 2.9.2 to trusted workspace members only until a fix is released.
Remove sensitive credentials from tool init_params where feasible and rotate any secrets exposed through the dispatch path.
Audit agent, skill, and workflow definitions for bindings to tools that the creators are not authorized to invoke.

Patch Information

No fixed version was available as of the vendor's advisory review. Monitor the MaxKB GitHub Security Advisory for release information and apply the update as soon as it is published.

Workarounds

Limit workspace membership and avoid provisioning low-role accounts in workspaces that contain tools with high-value credentials.
Segregate tools carrying sensitive init_params into workspaces that only trusted users can access.
Rotate any credentials stored in shared tools and consider using externally scoped, least-privilege API keys.

bash

# Configuration example
# Restrict MaxKB network exposure until a patched release is available
iptables -A INPUT -p tcp --dport 8080 -s <trusted_admin_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP