MaxKB: Unsalted MD5 Password Hashing

MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

MaxKB has Information Leak in sandbox

MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB: Sandbox escape via unhooked fexecve

MaxKB: Unauthenticated SSRF via Workflow Template Import

MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy

1Panel-dev MaxKB debug deserialization

MaxKB sandbox bypass

MaxKB: RCE via MCP stdio command injection in workflow engine

MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base

MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

MaxKB: Stored XSS via Unsanitized iframe_render Parsing

MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering

Stored XSS via Eval Injection in EchartsRander Component

MaxKB has Stored XSS via ChatHeadersMiddleware

MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB: Broken Access Control in MaxKB OSS URL Fetch API

MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch

MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

MaxKB has CSV Injection in its Application Chat Export Functionality

MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id