CVE-2026-39419

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39419", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T00:23:30.595Z", "datePublished": "2026-04-14T01:03:40.653Z", "dateUpdated": "2026-04-14T13:28:04.792Z"}, "containers": {"cna": {"title": "MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv"}, {"name": "https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25", "tags": ["x_refsource_MISC"], "url": "https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25"}, {"name": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0"}], "affected": [{"vendor": "1Panel-dev", "product": "MaxKB", "versions": [{"version": "< 2.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T01:03:40.653Z"}, "descriptions": [{"lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged result directly to file descriptor 1 (bypassing stdout redirection). By calling sys.exit(0), the attacker terminates the wrapper before it prints the legitimate output, causing the MaxKB service to parse and trust the spoofed response as the genuine tool result. This issue has been fixed in version 2.8.0."}], "source": {"advisory": "GHSA-f3c8-p474-xwfv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T13:27:54.273791Z", "id": "CVE-2026-39419", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:28:04.792Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39419", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T13:27:54.273791Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:27:59.458Z"}}], "cna": {"title": "MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing", "source": {"advisory": "GHSA-f3c8-p474-xwfv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "1Panel-dev", "product": "MaxKB", "versions": [{"status": "affected", "version": "< 2.8.0"}]}], "references": [{"url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv", "name": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25", "name": "https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0", "name": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged result directly to file descriptor 1 (bypassing stdout redirection). By calling sys.exit(0), the attacker terminates the wrapper before it prints the legitimate output, causing the MaxKB service to parse and trust the spoofed response as the genuine tool result. This issue has been fixed in version 2.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T01:03:40.653Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39419", "state": "PUBLISHED", "dateUpdated": "2026-04-14T13:28:04.792Z", "dateReserved": "2026-04-07T00:23:30.595Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T01:03:40.653Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MaxKB", "vendor": "1Panel-dev", "versions": [{"status": "affected", "version": "< 2.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*", "matchCriteriaId": "8BB376B6-4E9C-4801-9D33-5BF858C857D2", "versionEndExcluding": "2.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged result directly to file descriptor 1 (bypassing stdout redirection). By calling sys.exit(0), the attacker terminates the wrapper before it prints the legitimate output, causing the MaxKB service to parse and trust the spoofed response as the genuine tool result. This issue has been fixed in version 2.8.0."}, {"lang": "es", "value": "MaxKB es un asistente de IA de c\u00f3digo abierto para empresas. En las versiones 2.7.1 e inferiores, un usuario autenticado puede eludir la validaci\u00f3n de resultados de la sandbox y falsificar los resultados de ejecuci\u00f3n de herramientas explotando la introspecci\u00f3n de marcos de Python para leer el UUID del wrapper desde sus constantes de bytecode, y luego escribiendo un resultado forjado directamente en el descriptor de archivo 1 (eludiendo la redirecci\u00f3n de stdout). Al llamar a sys.exit(0), el atacante termina el wrapper antes de que imprima la salida leg\u00edtima, lo que hace que el servicio MaxKB analice y conf\u00ede en la respuesta falsificada como el resultado genuino de la herramienta. Este problema ha sido solucionado en la versi\u00f3n 2.8.0."}], "id": "CVE-2026-39419", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39419", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T13:27:54.273791Z", "version": "2.0.3"}}]}, "published": "2026-04-14T02:16:05.143", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.0)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "MaxKB", "source": "cna", "vendor": "1Panel-dev"}, "product": "maxkb", "vendor": "1panel"}], "analysis": {"en": {"generated_at": "2026-04-14T03:23:11.995945+00:00", "value": {"mitigation_remediation": ["Upgrade MaxKB to version\u00a02.8.0 or later to apply the vendor fix.", "If an immediate upgrade is not feasible, remove or downgrade privileged user access to prevent exploitation of the sandbox bypass.", "Consider monitoring process output and file descriptor writes for anomalies, and verify that tool results are validated against expected formats before use."], "summary": {"action": "Immediate Patch", "impact": "Trusted Result Spoofing"}, "threat_synthesis": {"affected_systems": "This flaw affects the MaxKB application developed by 1Panel\u2011dev. Versions\u00a02.7.1 and earlier are vulnerable; the issue was resolved in the 2.8.0 release.", "description_and_impact": "MaxKB, an open\u2011source enterprise AI assistant, allows an authenticated user to bypass the sandbox\u2019s result validation. The attacker exploits Python frame introspection to read the wrapper\u2019s UUID from bytecode constants and then writes a forged result directly to file descriptor\u00a01, bypassing stdout redirection. By invoking sys.exit(0) the wrapper is terminated before producing legitimate output, and the service parses and trusts the spoofed response as a real tool result, effectively granting the user the ability to inject arbitrary output into the assistant\u2019s responses.", "risk_and_exploitability": "The CVSS\u00a0v3.1 score of\u00a03.1 indicates a low severity vulnerability, and the EPSS score is not available. MaxKB is not listed in CISA\u2019s KEV catalog, suggesting no known exploits in the wild. Exploitation requires authenticated access and knowledge of the internal Python wrapper, making the attack surface relatively narrow and likely limited to privileged users. Nevertheless, because forged results are treated as legitimate, an attacker can expose sensitive data or influence downstream processes."}}}}, "created": "2026-04-14T16:16:11.751487+00:00", "updated": "2026-04-14T16:31:08.262886+00:00", "vendors": ["1panel", "1panel$PRODUCT$maxkb"]}