PT-2026-32573 · Maxkb · Maxkb

Liqiang · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39418

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description An authenticated user with tool-editing permissions can bypass sandbox network protection to reach internal services that are explicitly blocked by the banned hosts configuration. The sandbox utilizes LD PRELOAD to hook the connect() function to block connections to banned IPs. However, using socket.sendto() with the MSG FASTOPEN flag allows TCP connections to be established directly through the kernel without calling connect(), thereby bypassing IP validation. While sendto is included in the syscall() wrapper, it remains ineffective because glibc invokes the kernel syscall directly instead of routing through the hooked syscall() function.

Recommendations Update to version 2.8.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-39418

Affected Products

Maxkb

References · 7

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-w9g4-q3gm-6q6w · Vendor Advisory
• https://github.com/1Panel-dev/MaxKB/commit/4d06362750b15390437f1d2e4d14ec79baef8559 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39418 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEnew/status/2043976157477863723 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043993264944980347 · Twitter Post
• https://twitter.com/CVEarity/status/2044087197251645588 · Twitter Post