Execution Path Bypass Vulnerability in MaxKB AI Assistant from 1Panel
CVE-2026-79918

6.3MEDIUM

Key Information:

Vendor

1panel-dev

Status
Maxkb
Vendor
CVE Published:
21 September 2026

What is CVE-2026-79918?

MaxKB, an open-source AI assistant for enterprise applications, contains a vulnerability in its ToolExecutor that allows authenticated attackers to bypass the sandbox restrictions. Specifically, prior to version 2.10.6-lts, the sandbox protection mechanisms used LD_PRELOAD to prevent the creation of subprocesses. However, it failed to hook fexecve, enabling attackers to initiate processes beyond the sandbox's intended policies. Users should upgrade to version 2.10.6-lts to mitigate this security risk.

Affected Version(s)

MaxKB < 2.10.6-lts

References

https://github.com/1Panel-dev/MaxKB/security/advisories/G...
x_refsource_CONFIRM
https://github.com/1Panel-dev/MaxKB/commit/6fa7947a85030b...
x_refsource_MISC
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.6-lts
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.