PentAGI EUVD-2026-41795

Exploitation requires a valid low-privilege authenticated session on the PentAGI platform (PR:L per CVSS 4.0 vector) - unauthenticated attackers cannot exploit this directly without first obtaining credentials. The vulnerable component is the Docker API client (backend/pkg/docker/client.go), meaning Docker integration must be active in the PentAGI deployment, which is its standard operational mode. The attack is network-accessible (AV:N) with no user interaction required (UI:N) and low complexity (AC:L) once authentication is obtained. Exploitation is bounded to the Docker environment of the vulnerable system: subsequent-system metrics (SC:N/SI:N/SA:N) in the CVSS 4.0 vector indicate no host-level breakout is expected. The limiting factors for realistic risk are: requirement for authenticated access, low impact ceiling (all impacts rated Low), and niche product deployment footprint.

The CVSS 4.0 score of 5.3 (Medium) accurately characterizes the bounded nature of this flaw. AV:N and AC:L confirm network-reachable, low-complexity exploitation, but PR:L establishes that unauthenticated attackers cannot exploit this directly. All vulnerable-system impact metrics (VC:L/VI:L/VA:L) are Low, and subsequent-system metrics (SC:N/SI:N/SA:N) are all None, indicating the sandbox break does not extend to the underlying host - this is a meaningful constraint that lowers real-world risk compared to a full container escape. EPSS data is absent from the provided intelligence, and the vulnerability is not in CISA KEV. No POC has been publicly disclosed. The patch is an unmerged GitHub PR (#355), meaning no confirmed released fix version exists despite the 'Available from vendor' indicator - this gap increases residual exposure. Given PentAGI's niche deployment footprint, aggregate organizational risk is low, but any PentAGI deployment should treat this as a genuine sandbox weakening requiring prompt attention once a patched release is available.

An authenticated low-privilege PentAGI user submits a crafted request through the platform's Docker API client interface, triggering the improper sandbox boundary handling in backend/pkg/docker/client.go. The attacker gains read access to Docker environment data or resources outside their authorized scope, and may make limited unauthorized modifications within the container environment. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) means exploitation would require minimal technical knowledge once the vulnerable code path is identified.