CVE-2026-44847
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
MaxKB before version 2.9.0 exposes the webhook endpoint (/api/trigger/v1/webhook/{trigger_id}) without authentication. The WebhookAuth class returns (None, {}), which is interpreted as successful authentication. An unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute bound tasks.
Risk Assessment
An unauthenticated attacker can trigger any tasks configured as webhooks, potentially leading to unauthorized actions such as data exfiltration or system modification.
Recommendation
Update MaxKB to version 2.9.0 or later, which includes a fix enforcing authentication for the webhook endpoint.
Other vulnerabilities in MaxKB
See all- CVE-2026-64870Medium
MaxKB from version 2.0.0 to 2.10.4-lts in UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url to requests.get without trusted-host and redirect validation. An authenticated workspace user can make the server request internal, loopback, link-local, or cloud metadata URLs.
- CVE-2026-54149High
In MaxKB prior to 2.10.0-lts, the tool import functionality and MCP referencing mode do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file with stdio transport containing malicious commands and trigger execution via an AI Chat node, leading to arbitrary system command execution.
- CVE-2026-56779Medium
An SSRF vulnerability in MaxKB before version 2.10.0 allows authenticated users to make arbitrary server requests via unvalidated downloadCallbackUrl and download_url parameters in tool creation and update endpoints. Attackers with the default USER role can exploit this to access internal network services.
- CVE-2026-45413Medium
MaxKB stores user passwords using unsalted MD5 hashes, making them easily crackable via rainbow tables or GPU-accelerated brute force.
- CVE-2026-45412Medium
MaxKB prior to version 2.9.1 is vulnerable to SSRF (Server-Side Request Forgery) via work_flow_template import. Authenticated users can supply arbitrary URLs in work_flow_template.downloadUrl which are fetched server-side without any URL validation or internal IP filtering.
- CVE-2026-42337Medium
MaxKB version 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url). The endpoint uses application_id from the URL path without validating ownership, allowing attackers to perform operations under other applications’ policies.
- CVE-2026-42336Medium
MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services.
- CVE-2026-42335Medium
MaxKB before version 2.8.1 is vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch endpoint. Inconsistent URL parsing between the validation function and the HTTP client allows attackers to access internal network services.
Original NVD description (English source)
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication. The WebhookAuth class unconditionally returns (None, {}), which Django REST Framework interprets as successful authentication. Combined with optional per-trigger token verification and no backend enforcement of token requirements, any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute their bound tasks. This vulnerability is fixed in 2.9.0.