The vulnerability allows an authenticated workspace member of a MaxKB deployment to directly inject arbitrary control characters into the AWS Bedrock access_key_id and secret_access_key fields before they are written to the host’s .aws/credentials file. By appending a malicious credential_process entry, the attacker can create a new AWS profile that causes botocore to execute attacker‑controlled commands with root privileges during a subsequent model-validation request, resulting in full system compromise. This weakness corresponds to CWE‑78 (Command Injection).

Any MaxKB instance with a version earlier than 2.10.5‑lts, regardless of deployment location, is vulnerable when AWS Bedrock integration is enabled and workspace members can update credentials. The issue was identified in the 1Panel‑dev MaxKB project and resolved in release v2.10.5‑lts.

With a CVSS score of 9.1, the base severity indicates a critical impact should the vulnerability be abused. The EPSS score is not available, but the exploitation path requires an authenticated user to modify credentials, after which the command executes as root. Although not listed in the CISA KEV catalog, the high severity warrants immediate attention, as attackers could target organizations using MaxKB with weak internal access controls or unreviewed workspace members to hijack the system.