Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto() with the MSG_FASTOPEN flag. This allows authenticated user with tool-editing permissions to reach internal services that are explicitly blocked by the sandbox's banned hosts configuration. MaxKB's sandbox uses LD_PRELOAD to hook the connect() function and block connections to banned IPs, but Linux's sendto() with the MSG_FASTOPEN flag can establish TCP connections directly through the kernel without ever calling connect(), completely bypassing the IP validation. Although sendto is listed in the syscall() wrapper, this is ineffective because glibc invokes the kernel syscall directly rather than routing through the hooked syscall() function. This issue has been fixed in version 2.8.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚡ New CVE Alert: CVE-2026-39418 📊 Severity: 5.0 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-39418 #CVE-2026-39418 #CVE #Medium #CyberSecurity #InfoSec https://t.co/JWpGlR0tQ2
Post summary
The tweet announces CVE-2026-39418 as a medium‑severity vulnerability affecting unspecified products, but provides no technical details, PoC, exploit, or patch information.
CVE-2026-39418 Sandbox Network Protection Bypass in MaxKB Versions 2.7.1 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39418
Post summary
Announcement of a sandbox protection bypass in MaxKB 2.7.1 and earlier, without PoC, exploit, patch, or exploitation evidence.
CVE-2026-39418 MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto() with the MSG_FAS… https://www.cve.org/CVERecord?id=CVE-2026-39418
Post summary
A disclosure of CVE-2026-39418 reporting a sandbox bypass in MaxKB via socket.sendto(); no PoC, exploit, active use, or patch details are mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | maxkb | maxkb | - | - | - |