Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-79919

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym with RTLD_NEXT to resolve glibc&#39;s real syscall and bypass the sandbox syscall blacklist. An authenticated workspace member can consequently read or write files, execute processes, or access networks as the sandbox user. This issue is fixed in version 2.10.6-lts.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/09/2026

CVE-2026-77522

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user&#39;s URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77525

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted non-debug record for a victim&#39;s published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use add_knowledge to copy victim answers while updating the victim record&#39;s improve_paragraph_id_list. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77523

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the query. An authenticated user with model read permission in an attacker-controlled workspace can supply a known victim model_id to read or overwrite the victim&#39;s model_params_form in another workspace, potentially altering workflows that use those defaults. No fixed version is available as of this review.

Gravedad CVSS v3.1: ALTA

Última modificación:

22/09/2026

CVE-2026-77519

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application&#39;s tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77517

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id without confirming that the object belongs to that knowledge base. A normal workspace user with a known victim document or paragraph UUID can use an attacker-owned knowledge-base path to read or modify content in another user&#39;s knowledge base. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/09/2026

CVE-2026-77518

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user&#39;s active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcp_tool_id in a workflow mcp-node so workflow debug uses the owner&#39;s MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/09/2026

CVE-2026-77521

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container&#39;s string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

22/09/2026

CVE-2026-77520

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user&#39;s application_id from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range and the attacker knows or guesses its name, even though direct application detail and debug-open routes deny access. An attacker who can create and publish a workflow application can place the disclosed identifier in an attacker-owned workflow application-node, trigger that workflow, receive output generated by the victim application, and create durable application_chat and application_chat_record rows under the victim application because save and runtime paths do not verify permission to use the referenced application. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/09/2026

CVE-2026-77516

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it through the agent or workflow dispatch path. The dispatch path does not reapply the per-tool grant enforced by dedicated tool routes, and tool execution decrypts server-side init_params, allowing the caller to receive credentials carried by the denied tool. No fixed version is available as of this review.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/09/2026

CVE-2026-73551

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy&#39;s URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

05/10/2026

CVE-2026-73553

Fecha de publicación:

21/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy&#39;s router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

05/10/2026

Suscribirse a Vulnerabilidades