CVE-2026-6108: 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection

Vulnerability summary

CVE-2026-6108 is a medium (CVSS 6.5) vulnerability in 1panel-dev maxkb. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 73.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-04-2026
   PublishedVulnerability first disclosed.
2. 14-04-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/step_node/mcp_node/impl/base_mcp_node.py of the component Model Context Protocol Node. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
• CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.