CVE-2026-6108: 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection
A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/stepnode/mcpnode/impl/basemcpnode.py of the component Model Context Protocol Node. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6108?
CVE-2026-6108 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2026-6108?
To fix CVE-2026-6108, upgrade 1Panel-dev MaxKB to version 2.6.2 or later.
What component is affected by CVE-2026-6108?
CVE-2026-6108 affects the execute function in the base_mcp_node.py file of the 1Panel-dev MaxKB software.
What type of vulnerability is CVE-2026-6108?
CVE-2026-6108 is an OS command injection vulnerability.
What is the impact of exploiting CVE-2026-6108?
Exploitation of CVE-2026-6108 could allow an attacker to execute arbitrary commands on the server.