What happened
Published 2026-09-21. The credentials file handler writes user-supplied strings without parsing/sanitisation, enabling AWS profile injection. The profile is later resolved via credential_process, causing the MaxKB process (running as root in the official image) to execute the attacker's command.
Why it matters
An authenticated-but-low-privilege AI-app user converts a cloud-credential form into OS-level root code execution on the host serving the AI assistant, exposing the model config, workspace data and the host.
Attack vector
A workspace member injects control characters (newlines) into the Bedrock access_key_id / secret_access_key fields; _update_aws_credentials writes them unparsed into /root/.aws/credentials. The attacker appends a new AWS profile containing credential_process, then selects it during a later model-validation request so the AWS SDK (botocore) executes an attacker-controlled command as root.
Affected systems
MaxKB (1Panel-dev) < 2.10.5-lts
Mitigation
Upgrade to v2.10.5-lts (commit a1e413d196004421ab0953ee0baa13d4ca0fe3c4; GHSA-2324-7xjr-9qxg).