{"data":{"id":"774c20f0-d345-4e6f-ab15-5c3647761463","title":"CVE-2026-77516: MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member…","summary":"MaxKB, an open-source enterprise AI assistant, from version 2.0.0 through 2.9.2 lets a lowest-role workspace member bind and execute a tool they are denied by WorkspaceUserResourcePermission, using tool_ids, skill_tool_ids, or mcp_tool_ids through the agent or workflow dispatch path. Dispatch does not reapply the per-tool grant enforced by dedicated tool routes, so the caller can receive credentials in the denied tool's server-side init_params.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77516","publishedAt":"2026-09-21T21:17:10.143Z","cveId":"CVE-2026-77516","cweIds":["CWE-639","CWE-862"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["MaxKB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MaxKB tool execution through agent and workflow dispatch bypasses tool grants","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00242,"epssCheckedAt":"2026-11-09T18:09:52.268Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-08T06:09:40.664Z","patchAvailable":null,"disclosureDate":"2026-09-21T21:17:10.143Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}