CVE-2026-77518: MaxKB AI Assistant Auth Bypass Vulnerability

CVE-2026-77518 Overview

CVE-2026-77518 is a missing authorization vulnerability in MaxKB, an open-source AI assistant for enterprise workspaces. The flaw affects MaxKB versions 2.10.2-lts and earlier. A workspace user who knows another user's active MCP tool_id can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain Model Context Protocol (MCP) server configuration and headers. An attacker can also embed the foreign mcp_tool_id in a workflow mcp-node so workflow debug executes using the owner's MCP configuration.

Critical Impact
Authenticated workspace users can disclose sensitive MCP server configurations and reuse another user's MCP credentials during workflow debug without permission checks.

Affected Products

MaxKB 2.10.2-lts and earlier
MaxKB workspace multi-user deployments
MaxKB workflow engine using MCP tool nodes

Discovery Timeline

2026-09-21 - CVE-2026-77518 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77518

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in the MaxKB tool-detail API route. MaxKB enforces per-resource authorization on the tool list route but omits the same check on the tool-detail endpoint. Any authenticated workspace user who guesses or obtains a valid mcp_tool_id can fetch another user's hidden tool metadata.

The API response returns the Tool.code field, which frequently stores MCP server endpoints, authentication headers, and configuration payloads. Beyond passive disclosure, the workflow engine accepts a foreign mcp_tool_id in a mcp-node without verifying that the requesting user owns or may use that tool. Workflow debug then executes with the tool owner's MCP configuration, letting the attacker impersonate the owner against downstream MCP services.

Root Cause

The root cause is inconsistent access control between two API paths that operate on the same resource. The list endpoint filters tools by ownership, while the detail endpoint retrieves objects by identifier without repeating the ownership predicate. The workflow mcp-node handler compounds the issue by trusting client-supplied tool identifiers during debug execution.

Attack Vector

Exploitation requires only a low-privileged workspace account and knowledge of a target mcp_tool_id. The attacker calls the tool-detail route directly to read the hidden tool and its Tool.code. To pivot into active abuse, the attacker creates or edits an owned workflow, inserts an mcp-node referencing the foreign mcp_tool_id, and triggers workflow debug. See the GitHub Security Advisory GHSA-x65c-w438-c58f for further technical details.

Detection Methods for CVE-2026-77518

Indicators of Compromise

Requests to the MaxKB tool-detail route referencing mcp_tool_id values not owned by the requesting user.
Workflow definitions containing mcp-node entries whose mcp_tool_id references tools owned by other workspace users.
Unexpected outbound connections from MaxKB to MCP server endpoints during workflow debug sessions.

Detection Strategies

Correlate tool-detail API calls with the requester identity and compare against the tool owner recorded in the database.
Audit workflow debug invocations for mcp-node references that cross user ownership boundaries within the same workspace.
Review MaxKB application logs for repeated tool-detail requests iterating over sequential or enumerated tool_id values.

Monitoring Recommendations

Enable verbose logging on MaxKB API endpoints handling MCP tool resources and forward logs to a central SIEM.
Alert on outbound MCP traffic that does not map to the workflow owner's declared MCP configuration.
Track creation and modification events on workflows that include MCP tool nodes.

How to Mitigate CVE-2026-77518

Immediate Actions Required

Restrict MaxKB workspace membership to trusted users until a patched release is available.
Rotate any MCP server credentials, API keys, and headers stored in Tool.code for shared workspaces.
Disable or remove MCP tools that expose privileged downstream systems from multi-user workspaces.

Patch Information

No fixed version is available as of this review. Monitor the MaxKB GitHub Security Advisory GHSA-x65c-w438-c58f for release information and apply updates as soon as the maintainers publish a patched build.

Workarounds

Segregate MCP tool owners into single-user workspaces to eliminate cross-user access paths.
Block the tool-detail route at an upstream reverse proxy for non-administrative users where feasible.
Prevent workflow debug execution on shared instances until authorization is enforced on mcp-node references.

bash

# Example NGINX restriction for the tool-detail route
location ~ ^/api/tool/(?<tool_id>[^/]+)/detail$ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://maxkb_backend;
}