Executive brief
MaxKB is an AI assistant platform for enterprises that lets users run tools and workflows. The ToolExecutor component uses a sandbox to restrict what code can do, but it failed to block the fexecve system call—an alternative way to execute processes. An authenticated attacker with access to tool execution can exploit this to run arbitrary code outside the sandbox's restrictions, potentially compromising the server.
Technical details
The vulnerability is a sandbox bypass in the ToolExecutor's LD_PRELOAD-based syscall interception mechanism. The sandbox correctly hooks execve, execvpe, and execveat to enforce subprocess creation policy, but fexecve (which executes code via a file descriptor) was not hooked. An authenticated attacker with tool code execution can invoke fexecve to bypass subprocess restrictions.
Affected products
- 1Panel MaxKB prior to 2.10.6-lts
Timeline
- 2026-09-21: disclosed
- 2026-09-03: patched: Fixed in version 2.10.6-lts