MaxKB versions 2.7.1 and earlier contain an incomplete remediation for a remote code execution vulnerability in the MCP node of the workflow engine. The vulnerability exists because the code only restricts loading MCP configuration from the database but does not restrict loading mcp_servers from user-supplied JSON. Since the mcp_source field is optional, an attacker can omit or set it to a non-referencing value to bypass the fix. By sending a crafted JSON payload to the workflow creation API, an attacker can inject a malicious MCP node configuration with arbitrary commands and arguments. This leads to OS command injection and remote code execution when the workflow is triggered via chat. The vulnerability is resolved in MaxKB version 2.8.0.

An attacker with limited privileges can achieve remote code execution on affected MaxKB installations by injecting malicious MCP node configurations via the workflow creation API. This can lead to arbitrary command execution on the host system when the workflow is triggered. The impact includes potential compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 4.6 reflects a medium severity with network attack vector, high attack complexity, low privileges required, and user interaction needed.

This vulnerability is fixed in MaxKB version 2.8.0. Users should upgrade to version 2.8.0 or later to remediate this issue. No official patch or temporary fix is indicated for earlier versions. Until upgrading, avoid exposing the workflow creation API to untrusted users to reduce risk.