CVE-2025-53928 is a remote command execution flaw in the MCP call of MaxKB, the open source AI assistant for enterprise. NVD scores it Medium (CVSS 4.6). Versions 1.10.9-lts and 2.0.0 fix it, so upgrade to one of them and limit who can configure tool connections.
What's affected
The advisory says MaxKB versions before 1.10.9-lts and before 2.0.0 are affected. Two fixed versions exist because the project maintains two lines: 1.10.9-lts on the older line and 2.0.0 on the new one.
The problem sits in the code that handles a Model Context Protocol (MCP) call. MCP is the way an AI application connects to external tools, and a flaw there can turn a tool setting into a way to run code on the server.
The record gives few more details. It does not say who can reach the function or what privileges are needed beyond the score, so read the advisory for the exact conditions that apply to your deployment.
How to check if you're exposed
Find the version you run. MaxKB is commonly deployed as a container, so read the image tag:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i maxkb
If the tag is older than 1.10.9-lts on the 1.x line, or older than 2.0.0 on the new line, you are affected. Then review who can add or edit MCP tool configurations in your instance. Those accounts, and anyone who can take them over, are the people who could reach the flaw. Review the application and host logs for tool calls you do not recognise.
What to do now
- Upgrade MaxKB to 1.10.9-lts or 2.0.0, depending on the line you follow.
- Limit the accounts that can create or change MCP tool connections to a small named group.
- Run MaxKB in a container with a non-root user, a read only filesystem where possible, and no access to host secrets.
- Review stored tool configurations for entries nobody on the team created.
- Give the server only the network access it needs, so a command running there cannot reach internal systems freely.
Why it matters
The weakness is CWE-94, code injection. Data that should only describe a tool is used in a way that lets it run as a command. AI platforms make this easy to get wrong, because tool configuration often includes a command to launch and arguments to pass to it.
The rating is Medium, and that fits a flaw that needs some access first. It is still worth fixing quickly, since an AI platform often holds API keys for language model providers and connectors to internal data.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not report attacks.
Quick check
Why is the score only Medium for command execution?
The score reflects the access conditions in the vector. Command execution that needs an authenticated user is rated lower than the same flaw open to anyone, but the impact on the server can still be serious.
Which version should I move to?
Use 1.10.9-lts if you follow the older line, or 2.0.0 if you follow the new one. Both are named as fixes in the advisory.
Sources
Last reviewed: 18 October 2026.
