EUVD-2026-22176Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto() with the MSG_FASTOPEN flag. This allows authenticated user with tool-editing permissions to reach internal services that are explicitly blocked by the sandbox's banned hosts configuration. MaxKB's sandbox uses LD_PRELOAD to hook the connect() function and block connections to banned IPs, but Linux's sendto() with the MSG_FASTOPEN flag can establish TCP connections directly through the kernel without ever calling connect(), completely bypassing the IP validation. Although sendto is listed in the syscall() wrapper, this is ineffective because glibc invokes the kernel syscall directly rather than routing through the hooked syscall() function. This issue has been fixed in version 2.8.0.
AnalysisAI
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
Technical ContextAI
MaxKB implements network sandbox protection using LD_PRELOAD, a dynamic linking technique that intercepts library calls at runtime by preloading a shared object that provides hooked versions of functions like connect(). The vulnerability leverages Linux's TCP_FASTOPEN mechanism, exposed via socket.sendto() with the MSG_FASTOPEN flag, which performs a TCP three-way handshake during the sendto() call itself rather than in a separate connect() call. Because glibc optimizes by invoking the kernel syscall directly rather than routing through the hooked syscall() wrapper, the LD_PRELOAD hook for connect() is never triggered. This allows the kernel to establish the TCP connection before any userspace validation can occur. The root cause is CWE-918 (Server-Side Request Forgery), compounded by incomplete syscall interception. Affected products include MaxKB (CPE: cpe:2.3:a:1panel-dev:maxkb:*:*:*:*:*:*:*:*) in versions up to and including 2.7.1.
RemediationAI
Upgrade MaxKB to version 2.8.0 or later. The patch addresses the vulnerability by improving syscall interception to prevent MSG_FASTOPEN from bypassing the connect() hook. For organizations unable to upgrade immediately, restrict tool-editing permissions to trusted users only, and implement network-level controls (firewalls, egress rules) to block unauthenticated outbound connections from the MaxKB process to sensitive internal services. Patch details and commit information are available at https://github.com/1Panel-dev/MaxKB/commit/4d06362750b15390437f1d2e4d14ec79baef8559 and https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0.
MaxKB prior to version 1.10.8-lts contains an incomplete sandbox implementation that only blacklists binary execution in
Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role
OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated
Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke we
Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to
Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript thr
MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based s
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by expl
Server-side request forgery in MaxKB v2.8.0 and earlier allows authenticated low-privilege users to reach internal netwo
Server-Side Request Forgery in MaxKB before 2.9.1 allows authenticated users to pivot into internal network infrastructu
OS command injection in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to execute arbitrary
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today