CVE-2026-54149: MaxKB Unauthenticated Remote Code Execution via Malicious MCP Tool Import

Technical summary

MaxKB versions prior to 2.10.0-lts fail to consistently validate the MCP transport type during two separate operations: tool import (in apps/tools/serializers/tool.py) and MCP referencing mode (in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py). The vulnerability arises because the stdio transport mechanism is not properly restricted or validated before being passed to MultiServerMCPClient. An authenticated user can exploit this by crafting a .tool file with a stdio transport containing shell metacharacters or system commands. When the configuration is triggered through an AI Chat interaction, the MultiServerMCPClient processes the malicious transport configuration and executes the embedded commands on the underlying operating system, effectively achieving remote code execution within the server's security context.

Business impact

Organizations deploying MaxKB face the risk of authenticated insider threats or compromised user accounts leading to full system compromise. Since the attack requires valid credentials, the risk is elevated in environments where user account management is weak, where MaxKB is internet-facing with many user accounts, or where credentials may be shared or leaked. Successful exploitation could allow attackers to exfiltrate proprietary AI configurations, training data, or sensitive documents indexed within the system. The ability to execute arbitrary system commands could also be leveraged for lateral movement to other infrastructure, data theft, or deployment of persistent backdoors.

Affected systems

MaxKB versions prior to version 2.10.0-lts are affected. This includes all releases in the 2.9.x series and earlier branches. Users operating self-hosted MaxKB instances on-premises or in cloud environments (VMs, containers, Kubernetes) are directly impacted. The vulnerability does not affect upstream dependencies or other AI assistant projects, but any organization relying on MaxKB for internal knowledge management or customer-facing AI services should prioritize inventory and assessment.

Exploitability

Exploitability is moderate-to-high in likelihood but requires authentication as a prerequisite. An attacker cannot trigger this vulnerability anonymously; they must either possess valid MaxKB user credentials or have compromised an existing user account. The technical barrier to exploitation is relatively low: the attacker needs to understand how to structure a .tool file with a malicious stdio transport command. Public documentation on MCP formats and MaxKB's tool import flow would accelerate weaponization. Once a .tool file is imported, triggering the vulnerability is trivial—simply initiating an AI Chat interaction that references the malicious tool can cause command execution. The lack of consistent validation means there is no safety valve or warning mechanism to stop a misconfigured or malicious tool before execution.

Remediation

Immediate action: upgrade MaxKB to version 2.10.0-lts or later as soon as possible. This version contains fixes to both the tool import serializer and the MCP referencing validation logic. Organizations unable to patch immediately should implement application-level access controls: restrict tool import permissions to trusted administrators only, disable MCP referencing features if not required, and isolate MaxKB instances to internal networks without direct internet exposure. Consider using network segmentation or running MaxKB in a containerized environment with reduced system privileges to limit the blast radius of potential command execution.

Patch guidance

The vendor has released version 2.10.0-lts as the fixed version. Affected organizations should review the vendor's release notes and deployment guide for version 2.10.0-lts to confirm all changes and dependencies. Before upgrading production systems, test the patch in a staging environment to ensure compatibility with custom tools, integrations, or configurations specific to your deployment. If you maintain custom .tool files or scripts, audit them for compliance with the new validation logic post-patch. The upgrade path from 2.9.x to 2.10.0-lts should be straightforward for standard installations, but organizations with heavily customized deployments should consult the vendor's migration documentation.

Detection guidance

Monitor MaxKB application logs for unusual tool import activity, particularly imports from untrusted sources or with uncommon file structures. Look for log entries indicating stdio transport configuration in .tool files, as legitimate use of stdio transport is uncommon in typical enterprise scenarios. Monitor system-level process execution logs (auditd, Event Viewer, or equivalent) for unexpected child processes spawned by the MaxKB application process, especially those invoking shell interpreters (bash, sh, cmd.exe, powershell) with suspicious arguments. Network traffic analysis can flag suspicious outbound connections initiated from the MaxKB process. Host-based IDS/IPS rules targeting command injection patterns in MCP configurations may also be effective. Review access logs to correlate tool import events with specific user accounts and timestamps to identify potential insider threats or account compromise.

Why prioritize this

This vulnerability warrants urgent prioritization despite not yet being on the CISA KEV list. The HIGH CVSS score (8.8) reflects its combination of high impact (code execution) and relatively low attack complexity. The authentication requirement slightly reduces urgency compared to unauthenticated RCEs, but the presence of a known fix (version 2.10.0-lts) provides a clear remediation path. Organizations should treat this as a critical patch candidate for inclusion in the next patching cycle, particularly if MaxKB is internet-facing or accessible to a large number of users. Prioritize patching for any instances exposed to untrusted networks or handling sensitive data.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network vector—the vulnerability is exploitable remotely over the network through the MaxKB application interface; (2) Low attack complexity—no special conditions or advanced techniques are required beyond valid credentials; (3) Low privilege requirement—any authenticated user can perform the import and trigger actions; (4) No user interaction—once the tool is imported, the AI Chat interaction that triggers execution requires no additional social engineering; (5) Unchanged scope—the impact is confined to the MaxKB system itself; (6) High confidentiality, integrity, and availability impact—arbitrary code execution grants complete control over the server's resources and data. The score would be higher (9.0+) if the vulnerability were unauthenticated, reflecting the authentication gate as the primary mitigating factor.

Frequently asked questions