CVE-2026-44847: MaxKB: Webhook Trigger Authentication Bypass
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{triggerid}) is accessible without authentication. The WebhookAuth class unconditionally returns (None, {}), which Django REST Framework interprets as successful authentication. Combined with optional per-trigger token verification and no backend enforcement of token requirements, any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute their bound tasks. This vulnerability is fixed in 2.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxKB webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id})to a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44847?
The severity of CVE-2026-44847 is rated high with a score of 7.5.
How do I fix CVE-2026-44847?
To fix CVE-2026-44847, upgrade MaxKB to version 2.9.0 or later to ensure authentication is enforced on the webhook trigger endpoint.
What does CVE-2026-44847 affect?
CVE-2026-44847 affects the MaxKB open-source AI assistant for enterprise, specifically its webhook trigger endpoint.
What type of vulnerability is CVE-2026-44847?
CVE-2026-44847 is an authentication bypass vulnerability related to the webhook trigger functionality.
Is there any risk in using a vulnerable version of MaxKB regarding CVE-2026-44847?
Yes, using a vulnerable version of MaxKB allows unauthorized users to trigger webhooks without authentication, which can lead to potential security breaches.