ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0428

ACVE-2026-0428

MaxKB <=2.10.3-lts, asked to answer a chat with tools attached, let the agent use its shell backend to execute commands on the host instead of keeping the work inside the intended sandbox.

Exposure

Harness
MaxKB <=2.10.3-lts with an assistant that has a tool, MCP tool, skill or sub-application attached — confirmed, github.com
Model
any — unconfirmed
Goal
Any chat task handled by the tool-attached assistant (goal not stated by the source) — unconfirmed
Tools and settings
The deepagents shell backend and its execute tool; MAXKB_SANDBOX may be unset or bypassed — confirmed, github.com
Approval
The execute tool is not included in the listed interrupt approvals — confirmed, github.com
Input controlled by
content-author
What the agent does
The agent executes shell commands on the host or application container.
Harm
arbitrary-command
Reach
The host or application container and reachable internal services — confirmed, github.com (root, the network)
Condition
When untrusted chat or ingested content reaches a tool-attached assistant — confirmed, github.com

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity
CRITICAL
Status
Unverified
Kind
Code
Source date
2026-09-02
Modified
2026-09-25
Aliases
CVE-2026-77521, GHSA-f36j-f34j-h3rx
Affected
  • AgentHarness: maxkb — < 2.10.5-lts
Harness/product
maxkb
Classes
command-injection; over-privileged-combination; exposed-surface; CWE-78; CWE-250; CWE-749
Taxonomy
ASI: ASI05; ASI: ASI02; ATLAS: AML.T0053; ATLAS: AML.T0050
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Identifier CVE-2026-77521Confirmedcveawg.mitre.org2026-09-24
Identifier GHSA-f36j-f34j-h3rxConfirmedapi.github.com2026-09-24
Fixed in 2.10.5-ltsConfirmedcveawg.mitre.org2026-09-24
Severity CRITICAL; matches CNAConfirmedcveawg.mitre.org2026-09-24

In the wild

demonstrated · research

Description

What

The MaxKB advisory says chats with a tool, MCP tool, skill or sub-application are routed through a deepagents shell backend that exposes an execute tool. On affected deployments, the agent can run host commands, including when the input arrives through untrusted chat or ingested content.

Detection

The advisory includes a research reproduction on MaxKB 2.10.3-lts.

Fix

Upgrade to MaxKB 2.10.5-lts and do not expose shell execution to untrusted assistant input.

Fix

Upgrade MaxKB to 2.10.5-lts and remove untrusted access to shell-capable assistants.

  • Upgrade harness:maxkb to 2.10.5-lts. First patched version in the advisory. Owner: operator

References

ADVISORY

Report a problemJSON