PT-2026-32129 · Unknown · 1Panel-Dev Maxkb

Ana10Gy · Published 2026-04-12 · Updated 2026-04-12 · CVE-2026-6108

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1

Description A vulnerability exists in the execute function within the file apps/application/flow/step node/mcp node/impl/base mcp node.py of the Model Context Protocol Node component. Manipulation of this function can lead to operating system command injection, potentially allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed.

Recommendations Upgrade the affected component to a fixed version.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-6108

Affected Products

1Panel-Dev Maxkb

References · 8

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/30 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6108 · Security Note
• https://vuldb.com/vuln/356968/cti · Note
• https://twitter.com/CVEnew/status/2043156053861245030 · Twitter Post
• https://vuldb.com/vuln/356968 · Note
• https://twitter.com/CVEarity/status/2043302897962848435 · Twitter Post
• https://vuldb.com/submit/782279 · Note
• https://twitter.com/infoflowcloud/status/2043157268045156368 · Twitter Post