Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2026-39420 is a medium-severity OS Command Injection (CWE-78) vulnerability in Maxkb Maxkb. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39420 is a sandbox escape vulnerability in MaxKB, an open-source AI assistant for enterprise knowledge bases, affecting versions 2.7.1 and below. MaxKB employs an LD_PRELOAD-based sandbox via injection of sandbox.so to restrict untrusted Python code execution through the Tool Debug API. This shared object intercepts sensitive C library functions such as execve, socket, and open to limit network and file system access. However, the implementation incompletely protects against the /usr/bin/env utility, which sandboxed processes can execute, as rated at CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and mapped to CWEs-78 and CWE-693.
An authenticated user with tool execution privileges, which allows subprocess creation, can exploit this remotely with low complexity. By invoking the command "env -i python", the -i flag clears all environment variables, including LD_PRELOAD, before launching the Python interpreter. This spawns a native Python process free of sandbox hooks, enabling unrestricted remote code execution (RCE), arbitrary file access, and network connectivity, bypassing all intended restrictions.
The vulnerability was addressed in MaxKB version 2.8.0. Mitigation details are available in the GitHub security advisory (GHSA-7wgv-v2r3-7f7w), release notes for v2.8.0, and the fixing commit (2d17b08e6b060329803754a05e806d0ddecf3fa8), which security practitioners should review for patch deployment and verification instructions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22178
Vulnerability Data
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LD_PRELOAD-based sandbox. By env command the attacker can clear the environment…
more
variables and drop the sandbox.so hook, leading to unrestricted Remote Code Execution (RCE) and network access. MaxKB restricts untrusted Python code execution via the Tool Debug API by injecting sandbox.so through the LD_PRELOAD environment variable. This intercepts sensitive C library functions (like execve, socket, open) to restrict network and file access. However, a patch allowed the /usr/bin/env utility to be executed by the sandboxed user. When an attacker is permitted to create subprocesses, they can execute the env -i python command. The -i flag instructs env to completely clear all environment variables before running the target program. This effectively drops the LD_PRELOAD environment variable. The newly spawned Python process will therefore execute natively without any sandbox hooks, bypassing all network and file system restrictions. This issue has been fixed in version 2.8.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 6 OS baselines
V6.3.3V6.6.3V10.2.2V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of access authorizations via the protection mechanism itself.
AC-4 mandates use of information flow enforcement mechanisms to control data movement.
SC-2 requires separation of user and system functionality as a protection mechanism.
SC-28 requires protection mechanisms for information at rest.
SC-3 requires isolation of security functions from non-security functions.
SC-7 requires boundary protection mechanisms to monitor and control external communications.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authentication directly implements a core protection mechanism whose absence or misuse is the CWE.
Defining and enforcing access authorizations is a protection mechanism; proper use prevents the CWE.
Cryptographic and integrity controls are protection mechanisms whose correct deployment mitigates the CWE.
Encryption and integrity protections for transit are explicit protection mechanisms.
Logical network protections are protection mechanisms whose failure matches the CWE.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.
Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.
Requiring defined escalation paths, crisis activation criteria, and coordination procedures strengthens the overall protection mechanism so that a single control failure is less likely to leave the organization exposed.
By requiring a documented categorization and decision process for security events, the control ensures that protection mechanisms are not bypassed or ignored when anomalies occur.
Identifying and remediating control weaknesses that contributed to an incident reduces the likelihood that protection mechanisms will fail again.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-693
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-693
Windows 10 (2 rules)
- V-220865 The Windows Remote Management (WinRM) service must not use Basic authentication. prevents CWE-693
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. prevents CWE-693
Windows 11 (1 rule)
- V-253418 The Windows Remote Management (WinRM) service must not use Basic authentication. prevents CWE-693
Windows Server 2016 (1 rule)
- V-225012 Windows Server 2016 must be running Credential Guard on domain-joined member servers. prevents CWE-693
Windows Server 2019 (1 rule)
- V-205907 Windows Server 2019 must be running Credential Guard on domain-joined member servers. prevents CWE-693
Windows Server 2022 (1 rule)
- V-254441 Windows Server 2022 must be running Credential Guard on domain-joined member servers. prevents CWE-693