The vulnerability allows an attacker to inject arbitrary command payloads into the MCP node configuration by crafting a JSON payload when creating a workflow. This leads to remote code execution on the MaxKB server when the workflow is triggered, potentially compromising confidentiality, integrity, and availability. The flaw resides in an unpatched else branch that loads mcp_servers from user‑supplied data, an instance of OS Command Injection (CWE‑78) and Improper Input Validation (CWE‑20).

The affected product is MaxKB, an open‑source AI assistant developed by 1Panel‑dev. Version 2.7.1 and all earlier releases are vulnerable. The issue is present in the MCP node of the workflow engine; later releases, such as 2.8.0, incorporate the fix.

The CVSS score is 4.6, which classifies the risk as medium. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through the workflow creation API, so the attacker would need legitimate API access or the ability to inject the crafted JSON into the chat interface. Successful exploitation results in full code execution on the host, posing a severe threat to the entire system.