A standard workspace user who knows another user’s MCP tool_id can access hidden tool details through the tool‑detail endpoint because the endpoint lacks the required per‑resource authorization that the list route performs. The response contains Tool.code, which may include sensitive configuration data and HTTP headers, effectively leaking information that could be used to compromise the MCP server. The attacker can then embed this foreign mcp_tool_id in a workflow node they control, causing workflow debugging to execute using the owner’s configuration without validating privilege, potentially enabling further unauthorized actions.

MaxKB open‑source AI assistant from 1Panel-dev, version 2.10.2‑lts and earlier, which includes the vulnerable tool‑detail API.

With a CVSS score of 5, the vulnerability presents a moderate severity risk. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, there is no confirmed high‑volume exploitation activity currently. Nevertheless, an attacker who can guess or discover a colleague’s MCP tool identifier can retrieve privileged configuration information and embed it into workflow executions under their own account. This bypass of resource‑level authorization (CWE‑862) could allow the attacker to leverage internal tooling configurations, potentially enabling further lateral movement or privilege escalation within the same workspace.