CVE-2026-79916

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts

Description Authenticated workspace members can inject control characters into the AWS Bedrock access key id and secret access key fields. These values are processed by the update aws credentials() function and written to /root/.aws/credentials without safe parsing. This allows an attacker to append a new AWS profile containing a credential process, which can be triggered during a subsequent model-validation request, leading to the execution of arbitrary commands as root via botocore.

Recommendations Update to version 2.10.5-lts.