CVE-2026-79918

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subprocess creation but does not hook fexecve. An authenticated attacker able to execute tool code can call fexecve to start a process outside the sandbox's intended subprocess policy. This issue is fixed in version 2.10.6-lts.

• CWE-693

• https://github.com/1Panel-dev/MaxKB/commit/6fa7947a85030b87977c4026f33af11ca10dd1e6
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.6-lts
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-9mh9-v949-fwqh

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79910Acrobat Reader is affected by an out-of-bounds read vulnerab…5.5
• CVE-2026-79911A security vulnerability has been detected in TOTOLINK N600R…10
• CVE-2026-79912A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_…8.3
• CVE-2026-79913Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-79916MaxKB is an open-source AI assistant for enterprise. Prior t…9.1
• CVE-2026-79917MaxKB is an open-source AI assistant for enterprise. In 2.7.…6.5
• CVE-2026-79919MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-7992Insufficient validation of untrusted input in UI in Google C…8.8
• CVE-2026-79920Ajenti is a Linux & BSD modular server admin panel. Prior to…9.9
• CVE-2026-79921amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0,…8.9
• CVE-2026-7993Insufficient validation of untrusted input in Payments in Go…4.2
• CVE-2026-79938Dell PowerProtect Cyber Recovery, versions prior to 20.3, co…8.8