MaxKB allows a lowest–role workspace member to bind a tool it was denied access to through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it via the agent or workflow dispatch path. The dispatch path does not reapply per–tool grants, so the user can execute the tool and decrypt server–side init_params, exposing credentials carried by the denied tool. The flaw is a privilege‑escalation vulnerability that can leak sensitive credential information.

1Panel‑dev MaxKB versions 2.0.0 through 2.9.2 are affected. No fixed version is available at the time of this review.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. The attack vector is likely through the agent or workflow dispatch API, and it requires a legitimate workspace membership at the lowest role. Once exploited, the attacker can read decrypted init_params and obtain credentials, potentially compromising other services controlled by those credentials.