CVE-2026-6108
1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 12, 2026
- Updated
- Apr 14, 2026
- Reserved
- Apr 11, 2026
Description
A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/step_node/mcp_node/impl/base_mcp_node.py of the component Model Context Protocol Node. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
MaxKB1Panel-dev |
|
References
- VDB-356968 | 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionvdb-entrytechnical-description
- VDB-356968 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #782279 | 1Panel-dev MaxKB <= v2.6.1 Remote Code Executionthird-party-advisory
- https://github.com/AnalogyC0de/public_exp/issues/30exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.