PT-2026-32583 · Maxkb · Maxkb

Lowliqiang · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39419

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description An authenticated user can bypass sandbox result validation and spoof tool execution results. This is achieved by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants and writing a forged result directly to file descriptor 1, which bypasses stdout redirection. By calling the sys.exit(0) function, the attacker terminates the wrapper before the legitimate output is printed, leading the service to trust the spoofed response as the genuine tool result.

Recommendations Update to version 2.8.0.

Fix

Authentication Bypass by Spoofing

Protection Mechanism Failure

Special Elements Injection

Weakness Enumeration

CWE-290

CWE-693

CWE-74

Related Identifiers

CVE-2026-39419

Affected Products

Maxkb

References · 7

• https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25 · Patch
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39419 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044106687368573197 · Twitter Post
• https://twitter.com/CVEnew/status/2043976148623696269 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043977908088111396 · Twitter Post