CVE-2026-79916: MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credentialprocess, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root. This vulnerability is fixed in 2.10.5-lts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxKB AWS Bedrockto a version that resolves this vulnerability.Fixed in 2.10.5-lts
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MaxKB workspace member can exploit it. The vulnerable workflow involves supplying AWS Bedrock credentials and later selecting an injected AWS profile during model validation.
What access and interaction does an attacker need?
The attacker needs authenticated workspace-member access and must be able to set AWS Bedrock access_key_id and secret_access_key values. No additional user interaction is required.
What is the impact of successful exploitation?
An attacker can cause botocore to execute an attacker-controlled command as root by injecting an AWS profile with credential_process into /root/.aws/credentials. This can result in remote code execution with root privileges.
Which versions are affected and what fixes the issue?
MaxKB versions before 2.10.5-lts are affected. Upgrade to 2.10.5-lts to remediate the vulnerability.