PT-2026-32129

CVE-2026-6108

Published

2026-04-12

Updated

2026-04-12

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1

Description A vulnerability exists in the execute function within the file apps/application/flow/step node/mcp node/impl/base mcp node.py of the Model Context Protocol Node component. Manipulation of this function can lead to operating system command injection, potentially allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed.

Recommendations Upgrade the affected component to a fixed version.

Exploitability

Exploit

Fix

Impacts

Researchers

Ana10Gy

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')