Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-09-02

HighPrimary

MaxKB Prompt Injection Could Drive an Ungated Shell Tool to Host or Container Root Command Execution

Analysis of CVE-2026-77521, where tool-enabled MaxKB assistants exposed an ungated shell tool and a bypassable container sandbox.

MaxKBTool execution / MCPPrompt injection into an automatically exposed and ungated agent shell toolMaxKB assistants with tools, MCP servers, skills, or sub-applications on versions through 2.10.3-lts

What happened

In controlled tests, a tool-enabled MaxKB assistant invoked the auto-added execute tool from chat input, ran commands on the source host, and bypassed the official container's wrapper through shell syntax evaluated by the outer root shell.

Why it matters

Demonstrated command execution as the MaxKB application user on source deployments and escape from the intended unprivileged wrapper to root-context shell operations in the official container; public or embedded assistants could expose the path without authentication.

Missing authorization check

Explicit capability enablement and payload-bound human authorization before the agent's execute tool runs any shell command, independent of model alignment and chat authentication.

Would PP block it?

If shell execution is mediated outside the agent and requires a receipt bound to the exact command, target, identity, and purpose, prompt injection alone cannot authorize it. Once arbitrary code already runs through an unmediated local path, only separately gated downstream actions remain constrainable.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-09-02

    GitHub publishes GHSA-f36j-f34j-h3rx for CVE-2026-77521 with Lasso Security's technical proof of concept.

  2. 2026-09-08

    The advisory is updated; GitHub lists MaxKB 2.10.5-lts as the patched version.

Technical breakdown

  • Any assistant with a tool, MCP server, skill, or sub-application entered a deepagents path backed by SandboxShellBackend.
  • deepagents automatically added execute and filesystem tools; MaxKB did not exclude execute, and its interrupt configuration covered file tools but not execute.
  • With MAXKB_SANDBOX unset on a source deployment, commands ran directly through subprocess with shell execution as the application user.
  • In the official container, the root shell interpreted metacharacters and redirections outside the gosu sandbox-user wrapper, allowing the researchers to create a root-owned file.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Before the deepagents execute tool and before protected downstream credentials, deployments, publications, or infrastructure mutations
Still needs
Vulnerable backend selection, shell-wrapper correctness, container isolation, host compromise containment, and local command paths that bypass the external gate remain outside coverage.
Receipt required for
Enabling shell capability and executing the exact command with a named signer, bounded target, and expiry

A Tool-Call Gate can require an external signer before execute runs, but Permission Protocol does not remove the hidden shell capability, repair the sandbox wrapper, or contain a compromised MaxKB host.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop