PT-2026-32575 · Maxkb · Maxkb

Liqiang · CVE-2026-39421 · Published 2026-04-14 · Updated 2026-04-14

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description A sandbox escape exists in the ToolExecutor component. An authenticated attacker with workspace privileges can bypass the LD PRELOAD-based sandbox.so module by using the Python ctypes library to execute raw system calls. This allows for arbitrary code execution via direct kernel system calls, which can lead to container compromise and full network exfiltration. The sandbox.so module intercepts standard system functions such as 'execve', 'system', 'connect', and 'open', as well as 'mprotect' to prevent PROT EXEC (executable memory) allocations, but it fails to block 'pkey mprotect'.

Recommendations Update to version 2.8.0.

Exploit

Fix

Protection Mechanism Failure

Code Injection

Weakness Enumeration

CWE-693

CWE-94

Related Identifiers

CVE-2026-39421

GHSA-9C6W-J7W5-3GF7

Affected Products

Maxkb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39421.json · Exploit
• https://github.com/1Panel-dev/MaxKB/commit/479701a4d2e6059506bad0057a66bed91abb5aef · Patch
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-9c6w-j7w5-3gf7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39421 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044092757426483392 · Twitter Post
• https://twitter.com/CVEnew/status/2043976152646090869 · Twitter Post