CVE-2026-77521

Executive Summary

CVE-2026-77521 is a critical OS command injection vulnerability (CWE-78) in MaxKB, an open-source enterprise AI assistant, affecting versions prior to 2.10.5-lts. Assistants configured with a tool, MCP tool, skill, or sub-application use a SandboxShellBackend that exposes an execute shell tool without excluding it and omits "execute" from interrupt_on, meaning human approval is never required before command execution. Untrusted chat input or ingested content can therefore trigger arbitrary command execution, and because the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox, exploitation can break out of the sandbox entirely. With a CVSS score of 10.0 and network-reachable, unauthenticated exploitation, this is a maximum-severity issue requiring immediate remediation.

Technical Analysis

The vulnerability resides in MaxKB's tool-execution architecture. When an assistant is configured with any of the following capabilities — a tool, an MCP tool, a skill, or a sub-application — the platform routes shell-capable actions through a component identified as SandboxShellBackend. Two design flaws combine to create the exposure:

1. Unremoved execute tool: SandboxShellBackend exposes an "execute shell" tool but does not exclude it from the assistant's available toolset. This means the shell execution primitive is directly reachable from the assistant's normal interaction flow.

2. Missing interrupt_on entry: The "execute" action is omitted from the interrupt_on configuration. In frameworks that require human-in-the-loop approval for dangerous operations, interrupt_on normally forces an approval gate. Because "execute" is not listed, the approval requirement is bypassed entirely, and shell commands run without a human decision point.

Combined, these flaws mean that any input reaching the assistant — an untrusted chat message or ingested content (such as documents or web content pulled into the knowledge base) — can steer the assistant into invoking the execute shell tool, which then runs commands on the host.

The impact is compounded by two deployment-specific behaviors:

• Source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, with no sandboxing at all.
• The official root container used a string-based gosu wrapper. Because gosu was invoked with a constructed string rather than a properly separated argument vector, shell metacharacters in the command could be interpreted by a shell, allowing execution outside the intended sandbox and potentially with the container's root-level privileges.

The root cause is a classic command-injection pattern (CWE-78): user-influenced input flows into a shell execution path without adequate sanitization, isolation, or an approval gate. The vulnerability class is OS command injection enabled by an insufficiently restricted, approval-bypassed tool interface.

No public proof-of-concept, exploit code, or Nuclei template is currently available. The attack chain described below is inferred from the vulnerability class and the behaviors documented in the NVD description; no specific function names, API paths, or parameters beyond those named in the description should be assumed.

Exploitation Scenarios

1. Reconnaissance / target identification An attacker identifies a MaxKB deployment reachable over the network — typically an enterprise AI assistant portal. Public scanning can locate instances by HTTP title or body content referencing MaxKB. The attacker determines whether assistants are configured with tools, MCP tools, skills, or sub-applications, since those configurations activate SandboxShellBackend and are the precondition for exploitation.

2. Triggering the flaw The attacker interacts with the assistant through a normal chat interface or supplies content that the assistant will ingest (for example, documents or external content pulled into its knowledge base). Because the execute shell tool is exposed and "execute" is omitted from interrupt_on, the attacker's crafted content can cause the assistant to invoke the shell execution tool. No human approval prompt appears, so the command runs without an operator decision. This requires no authentication (PR:N) and no user interaction beyond the assistant itself acting on attacker-influenced input (UI:N).

3. Payload / execution method at the vulnerability-class level The payload is a shell command delivered through the assistant's tool-invocation path. In source deployments where MAXKB_SANDBOX is disabled, the command executes directly as the application user. In the official root container, the string-based gosu wrapper allowed shell metacharacters to be interpreted, so an attacker can chain commands that execute outside the intended sandbox — a sandbox escape that may yield command execution with elevated privileges relative to the sandbox's intent. Because this is an OS command injection class, success yields arbitrary command execution in the context in which the command runs.

4. Post-exploitation impact Successful exploitation gives the attacker arbitrary command execution on the MaxKB host. Given the CVSS vector (S:C, C:H/I:H/A:H), impact crosses a security boundary and fully compromises confidentiality, integrity, and availability. Attackers could read sensitive data (chat history, ingested documents, credentials and API keys used by the assistant's tools), modify or destroy data, pivot into connected systems reachable by the application, and disrupt or disable the service. The scope change (S:C) reflects the sandbox-escape behavior: compromise of the assistant's execution context extends to the underlying host and potentially adjacent resources.

No public PoC is available; the chain above reflects the vulnerability class (OS command injection via an approval-bypassed, unremoved shell tool) and the deployment behaviors documented by the vendor.

Impact Assessment

Business impact is severe. MaxKB is deployed as an enterprise AI assistant and frequently integrates with internal tools, MCP servers, skills, and sub-applications — architectures that often hold credentials and API keys for downstream systems. An attacker who achieves command execution can exfiltrate sensitive enterprise data, tamper with or destroy systems, and pivot deeper into the environment.

CVSS subscores reinforce the severity:

• AV:N (Network) — exploitable remotely across the network.
• AC:L (Low) — no special conditions or race windows required.
• PR:N (None) — no authentication needed.
• UI:N (None) — no action from a legitimate user beyond the assistant processing content.
• S:C (Changed) — the exploited component (assistant/sandbox) affects resources beyond its intended privilege scope, consistent with the sandbox-escape behavior in the root container.
• C:H / I:H / A:H — total loss of confidentiality, integrity, and availability.

The resulting base score is 10.0, the maximum possible. Blast radius depends on deployment: source installs with MAXKB_SANDBOX disabled expose the application user's privileges directly, while the official root container may permit execution beyond the sandbox, increasing the risk of host-level compromise. Because MaxKB often connects to internal knowledge bases and tools, lateral movement potential is significant.

Detection Guidance

Sigma Rule

title: MaxKB SandboxShellBackend Command Execution Attempt
id: 3f9c1a72-8b4e-4d21-9a55-7c2e6d0b1f44
status: experimental
description: Detects suspicious shell command execution spawned by the MaxKB application process, consistent with abuse of the SandboxShellBackend execute tool (CVE-2026-77521).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77521
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/maxkb'
  selection_cmd:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '/bin/sh -c'
      - 'curl '
      - 'wget '
      - 'base64 -d'
  condition: selection_parent and selection_cmd
falsepositives:
  - Legitimate tool execution by configured assistants
level: high
tags:
  - attack.t1190
  - attack.t1059.004

YARA Rule

rule CVE_2026_77521_MaxKB_Command_Injection
{
    meta:
        description = "Detects references to MaxKB SandboxShellBackend execute-tool abuse (CVE-2026-77521)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77521"
        severity = "critical"

    strings:
        $s1 = "SandboxShellBackend" ascii wide nocase
        $s2 = "MAXKB_SANDBOX" ascii wide nocase
        $s3 = "interrupt_on" ascii wide nocase
        $s4 = "execute" ascii wide nocase
        $s5 = "MaxKB" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        (($s1 and $s2) or ($s1 and $s3) or ($s4 and $s2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77521 MaxKB Shell Tool Command Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"maxkb"; http.uri; nocase; content:"|3b|"; http_client_body; content:"|24 28|"; http_client_body; reference:cve,2026-77521; classtype:attempted-admin; sid:202677521; rev:1;)

Elastic Detection

process where event.type == "start" and
process.parent.name in ("python", "python3", "maxkb") and
(process.command_line : "*/bin/sh -c*" or
 process.command_line : "*;*curl*" or
 process.command_line : "*;*wget*" or
 process.command_line : "*$(*" or
 process.command_line : "*&&*base64*")

Splunk SPL Query

index=endpoint sourcetype=process_creation
| search (ParentProcessName IN ("python","python3","maxkb"))
  (CommandLine="*;/bin/sh*" OR CommandLine="*&&*" OR CommandLine="*$(*" OR CommandLine="*`*")
  (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*base64*")
| stats count min(_time) as first_seen values(CommandLine) as cmd by host, ParentProcessName, User
| sort - count

Wazuh OSSEC Rule

<group name="maxkb,web,">
  <rule id="100421" level="12">
    <if_sid>554</if_sid>
    <match>SandboxShellBackend</match>
    <description>CVE-2026-77521: Possible MaxKB shell tool command execution attempt detected.</description>
    <mitre>
      <id>T1190</id>
      <id>T1059.004</id>
    </mitre>
  </rule>
  <rule id="100422" level="13">
    <if_sid>592</if_sid>
    <match>python|python3|maxkb</match>
    <regex>/bin/sh -c|;.*(curl|wget|base64)|&&|\$\(</regex>
    <description>CVE-2026-77521: Suspicious shell execution spawned by MaxKB process parent.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Upgrade to version 2.10.5-lts, which the vendor states fixes this issue. Because automated patch-tracking sources have not confirmed the fix, validate the patch manually after applying by testing that shell execution requires approval and that the execute tool cannot be invoked by unconfigured assistants.
• Do not expose MaxKB directly to untrusted networks. Place it behind authentication, network segmentation, and a reverse proxy with strict access control so that untrusted chat/ingested-content sources cannot reach the assistant.
• Where the sandbox is configurable, ensure MAXKB_SANDBOX is enabled (do NOT disable it). Avoid running the official root container configuration that wraps gosu in a string, as this permits metacharacter breakout. Run the application as a dedicated, least-privileged non-root user.
• Restrict the assistant's tools, MCP tools, skills, and sub-applications to only those strictly required. Remove or disable shell-capable tools where possible.
• Audit ingested content sources and knowledge bases; treat all ingested content as untrusted.

2. Patch/upgrade steps

• Back up configuration and data.
• Upgrade MaxKB to 2.10.5-lts or later from the official release channel.
• Re-verify tool exposure and interrupt_on configuration after upgrade.
• Confirm the container user and sandbox settings match hardened configuration.

3. Long-term hardening

• Enforce human-in-the-loop approval (interrupt_on) for all shell-capable tool invocations by default; never leave dangerous tools implicitly approved.
• Apply least privilege to the MaxKB service account and container runtime.
• Adopt egress filtering so that command injection cannot easily exfiltrate data or fetch second-stage payloads.
• Monitor for process anomalies spawn-chained from the MaxKB process, as reflected in the detection rules above.
• Maintain an SBOM/vulnerability-tracking process so that critical unpatched issues are surfaced promptly.

References

• NVD — CVE-2026-77521: https://nvd.nist.gov/vuln/detail/CVE-2026-77521
• MaxKB project (vendor/product source): https://github.com/1Panel-dev/MaxKB
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-77521 is NOT currently listed in KEV; no exploit-in-the-wild or threat-actor campaign evidence is available at this time)