CVE-2026-39425 1Panel-dev CVE debrief

Who should care

Defenders responsible for MaxKB deployments, particularly those using versions 2.7.1 and below, should assess exposure and prioritize patching to version 2.8.0 or later. They should review application configurations for potential exposure and monitor for suspicious activity on affected systems. Additionally, defenders should consider compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remed

Why it matters

CVE-2026-39425 is a Stored Cross-Site Scripting (XSS) vulnerability in MaxKB that allows authenticated users to inject arbitrary HTML and JavaScript, enabling persistent DOM-based Stored XSS execution against any visitor who opens the affected chatbot interface. Defenders should prioritize patching to version 2.8.0 or later and review application configurations for potential exposure.

• Session hijacking and unauthorized actions performed on behalf of victims
• Sensitive data exposure through persistent DOM-based Stored XSS execution
• Potential for attackers to perform actions such as deleting workspaces or applications

Technical summary

The vulnerability allows authenticated users to inject arbitrary HTML and JavaScript into the Application prologue field, which is then rendered using an innerHTML-equivalent mechanism, enabling persistent DOM-based Stored XSS execution against any visitor who opens the affected chatbot interface. This issue arises because the backend fails to sanitize or encode HTML entities in the prologue field when applications are created or updated via the /admin/api/workspace/{workspace_id}/application endpoint, storing the raw payload directly in the database. Exploitation can lead to session hijacking, unauthorized actions performed on behalf of victims, and sensitive data exposure.

Defensive priority

Defenders should prioritize patching to version 2.8.0 or later and review application configurations for potential exposure.

Recommended defensive actions

• Patch MaxKB to version 2.8.0 or later
• Review application configurations for potential exposure
• Monitor for suspicious activity on affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the backend failing to sanitize or encode HTML entities in the prologue field when applications are created or updated via the /admin/api/workspace/{workspace_id}/application endpoint, storing the raw payload directly in the database.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.