This release includes 10 security fixes for security teams reviewing exposed deployments.
Topics
+6 more
Affected surfaces
ReleasePort's take
Moderate signalRelease v2.10.4‑lts patches critical security flaws: system permission leakage, IDOR in admin chat logs, horizontal privilege escalation across knowledge bases, expired API key usage at /chat/api/mcp, and prompt injection risks.
Why it matters: All fixes address high-severity (severity 90) vulnerabilities that enable anonymous resource access, cross‑application record reads, unauthorized document access, stale credential use, and command execution; immediate patching is required for security compliance.
Summary
AI summaryFixed multiple security vulnerabilities including IDOR, privilege escalation, SSRF, and prompt injection.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes system file permission flaw allowing anonymous resource access. Fixes system file permission flaw allowing anonymous resource access. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | Critical |
Fixes IDOR vulnerability in admin chat logs enabling cross‑application record reads. Fixes IDOR vulnerability in admin chat logs enabling cross‑application record reads. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | Critical |
Fixes horizontal privilege escalation allowing unauthorized document and segment access across knowledge bases. Fixes horizontal privilege escalation allowing unauthorized document and segment access across knowledge bases. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | Critical |
Fixes usage of expired agent API keys at `/chat/api/mcp` endpoint. Fixes usage of expired agent API keys at `/chat/api/mcp` endpoint. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | Critical |
Fixes horizontal privilege escalation caused by defective MCP tool authorization logic. Fixes horizontal privilege escalation caused by defective MCP tool authorization logic. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Fixes exposure of application IDs on homepage ranking page enabling unauthorized node calls. Fixes exposure of application IDs on homepage ranking page enabling unauthorized node calls. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Fixes prompt injection vulnerability mitigating agent command execution risk. Fixes prompt injection vulnerability mitigating agent command execution risk. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Adds independent authorization verification for agent and workflow tool scheduling. Adds independent authorization verification for agent and workflow tool scheduling. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Security | High |
Fixes missing host validation when UpdateStoreTool fetches external app store URLs. Fixes missing host validation when UpdateStoreTool fetches external app store URLs. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Security | High |
Fixes cross‑workspace privilege escalation when viewing/editing model parameter forms. Fixes cross‑workspace privilege escalation when viewing/editing model parameter forms. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Security | Medium |
Improves internal IP validation for web document import and sync crawlers to remediate SSRF risks. Improves internal IP validation for web document import and sync crawlers to remediate SSRF risks. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes newly added vision models not appearing in real‑time model list for advanced agents. Fixes newly added vision models not appearing in real‑time model list for advanced agents. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes incorrect prompt messages after deleting LLM bound to basic agents. Fixes incorrect prompt messages after deleting LLM bound to basic agents. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes failures when agents call shared models with "Model does not exist" error. Fixes failures when agents call shared models with "Model does not exist" error. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Allows full retrieval of all users via the user listing API, removing 200‑record limit. Allows full retrieval of all users via the user listing API, removing 200‑record limit. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Fixes misclassification of segmented text as table content in Word files without blank lines. Fixes misclassification of segmented text as table content in Word files without blank lines. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Fixes cross‑document contamination of segment position data when reordering segments. Fixes cross‑document contamination of segment position data when reordering segments. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Prevents agents without permissions from being searchable by name on ranking detail page. Prevents agents without permissions from being searchable by name on ranking detail page. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Fixes duplicated task display in scheduled trigger list details. Fixes duplicated task display in scheduled trigger list details. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Ensures default values are passed for user input parameters of advanced agents under triggers. Ensures default values are passed for user input parameters of advanced agents under triggers. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Fixes parameter passing errors when agent user inputs include toggle-type parameters in triggers. Fixes parameter passing errors when agent user inputs include toggle-type parameters in triggers. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
Security Vulnerability Fixes
- Vulnerability: Fixed a system file permission flaw that allowed anonymous access to resources;
- Vulnerability: Fixed an IDOR vulnerability in admin chat logs which allowed bypassing application path authentication to read cross-application chat records;
- Vulnerability: Added independent authorization verification mechanism for agent and workflow tool scheduling;
- Vulnerability: Fixed missing host validation when UpdateStoreTool fetches external app store URLs;
- Vulnerability: Fixed the horizontal privilege escalation issue that enabled users to access and modify unauthorized documents and segments across knowledge bases;
- Vulnerability: Fixed expired agent API keys being usable at the
/chat/api/mcpendpoint; - Vulnerability: Fixed horizontal privilege escalation caused by defective MCP tool authorization logic;
- Vulnerability: Fixed exposure of application IDs on the homepage ranking page, which could lead to unauthorized calls to other users' application nodes;
- Vulnerability: Fixed the risk of cross-workspace privilege escalation when viewing and editing model parameter forms;
- Vulnerability: Fixed prompt injection vulnerability to mitigate the risk of agent command execution;
- Vulnerability: Improved internal IP validation for web document import and sync crawlers to remediate SSRF risks.
Bug Fixes
- Agent: Fixed the issue that newly added vision models for image understanding nodes in advanced agents were not displayed in the model list in real time (#6402);
- Agent: Fixed incorrect prompt messages during conversations after deleting the LLM bound to basic agents;
- Agent: Fixed failures when agents call shared models with the error "Model does not exist";
- Knowledge Base: Fixed misclassification of segmented text as table content when there is no blank line between tables and subsequent content in Word files (#6396);
- Knowledge Base: Fixed cross-document contamination of segment position data when dragging and reordering document segments (#6373);
- Homepage: Fixed the issue where agents without user permissions could be searched by name on the ranking detail page;
- Trigger: Fixed duplicated task display in task details of scheduled trigger lists;
- Trigger: Fixed missing default value passing for user input parameters of advanced agents under trigger scenarios, resulting in empty parameter values (#6320);
- Trigger: Fixed parameter passing errors when agent user inputs include toggle-type parameters in triggers;
- User Management: Fixed the issue that the user listing API only returns the first 200 users and cannot fetch all user records (#6375).
Security Fixes
- Fixed system file permission flaw allowing anonymous access to resources
- Fixed IDOR vulnerability in admin chat logs bypassing authentication to read cross-application records
- Added independent authorization verification for agent and workflow tool scheduling
- Fixed missing host validation when UpdateStoreTool fetches external app store URLs (SSRF risk)
- Fixed horizontal privilege escalation enabling unauthorized document access and modification across knowledge bases
- Fixed usage of expired agent API keys at /chat/api/mcp endpoint
- Fixed horizontal privilege escalation caused by defective MCP tool authorization logic
- Fixed exposure of application IDs on homepage ranking page leading to unauthorized calls
- Fixed cross-workspace privilege escalation when viewing/editing model parameter forms
- Fixed prompt injection vulnerability mitigating agent command execution risk
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MaxKB
All releases →Related context
Beta — feedback welcome: [email protected]