CVE-2026-44847 Details

A vulnerability exists in MaxKB's webhook trigger endpoint, which is accessible without authentication. This issue affects MaxKB versions prior to 2.9.0. The vulnerability arises because the WebhookAuth class always returns a successful authentication response, allowing any unauthenticated attacker who knows a valid trigger ID to invoke webhook triggers and execute their associated tasks. This exploitation is possible due to the lack of mandatory token requirements for event triggers, combined with the absence of backend enforcement to validate token presence when creating triggers via the API.

Users are advised to upgrade to MaxKB version 2.9.0 or later, where this vulnerability has been fixed by making tokens mandatory for event triggers, correcting the authentication response in WebhookAuth, and including a migration to add tokens to existing untokened triggers. If an immediate upgrade is not possible, tokens can be manually added to existing event triggers, the sandbox feature can be enabled to limit the impact of any code execution, and network access to the webhook endpoint can be restricted to trusted IPs.