CVE-2026-44847: MaxKB: Webhook Trigger Authentication Bypass

Vulnerability summary

CVE-2026-44847 is a high (CVSS 7.5) Improper Authentication vulnerability in 1panel-dev maxkb. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 19.3% of scored vulnerabilities.

Timeline

1. 26-05-2026
   PublishedVulnerability first disclosed.
2. 01-06-2026
   Last modifiedVulnerability information updated.

Description

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication. The WebhookAuth class unconditionally returns (None, {}), which Django REST Framework interprets as successful authentication. Combined with optional per-trigger token verification and no backend enforcement of token requirements, any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute their bound tasks. This vulnerability is fixed in 2.9.0.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.