# CVE-2026-79918: MaxKB ToolExecutor sandbox bypass via fexecve

Source: https://junglewise.ai/threats/cve-2026-79918-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79918 · Severity: medium · CVSS 6.3 · Published 2026-09-21

MaxKB is an AI assistant platform for enterprises that lets users run tools and workflows. The ToolExecutor component uses a sandbox to restrict what code can do, but it failed to block the fexecve system call—an alternative way to execute processes. An authenticated attacker with access to tool execution can exploit this to run arbitrary code outside the sandbox's restrictions, potentially compromising the server.

Technologies: [1Panel MaxKB](https://junglewise.ai/threats/technologies/1panel-maxkb). Vendors: [1Panel](https://junglewise.ai/threats/vendors/1panel).

## Quick answers

**Is CVE-2026-79918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79918 being exploited in the wild.

**How severe is CVE-2026-79918?** Medium severity, with a CVSS score of 6.3, published 21 September 2026.

**Which products and versions are affected?** 1Panel MaxKB prior to 2.10.6-lts.

**Is there a fix for CVE-2026-79918?** A patch was published on 2026-09-03: Fixed in version 2.10.6-lts Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79918 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79918?** Check whether you run 1Panel MaxKB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a sandbox bypass in the ToolExecutor's LD_PRELOAD-based syscall interception mechanism. The sandbox correctly hooks execve, execvpe, and execveat to enforce subprocess creation policy, but fexecve (which executes code via a file descriptor) was not hooked. An authenticated attacker with tool code execution can invoke fexecve to bypass subprocess restrictions.

## Affected products

- 1Panel MaxKB prior to 2.10.6-lts

## Timeline

- 2026-09-21: disclosed
- 2026-09-03: patched: Fixed in version 2.10.6-lts

## References

- [https://github.com/1Panel-dev/MaxKB/commit/6fa7947a85030b87977c4026f33af11ca10dd1e6](https://github.com/1Panel-dev/MaxKB/commit/6fa7947a85030b87977c4026f33af11ca10dd1e6)
- [https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.6-lts](https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.6-lts)

## Related threats

- [MaxKB sandbox bypass via dlopen and dlsym](https://junglewise.ai/threats/cve-2026-79919-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to)
- [MaxKB chat share-link endpoint missing owner verification](https://junglewise.ai/threats/cve-2026-79917-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-7-0)
- [MaxKB credential injection in AWS Bedrock configuration](https://junglewise.ai/threats/cve-2026-79916-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to-2-10)
- [MaxKB missing per-tool authorization in agent and workflow dispatch](https://junglewise.ai/threats/cve-2026-77516-maxkb-is-an-open-source-ai-assistant-for-enterprise-from-version)