CVE-2025-66419 is a high severity (CVSS 8.8) race condition in the MaxKB tool module. Under certain concurrent conditions, an attacker can escape the sandbox and escalate privileges. MaxKB 2.3.1 and earlier are affected, and version 2.4.0 fixes it. The record and the advisory agree on the rating.
What's affected
- Product: MaxKB, an open source AI assistant platform for enterprises.
- Affected: 2.3.1 and below (the advisory writes it as 2.3.1 and earlier).
- Fixed: 2.4.0. The v2.4.0 release notes list a fix for a permission bypass under specific concurrent conditions that names this CVE.
- Access: the record vector shows low privileges, so an account that can use the tool feature is needed.
The release notes also mention a second fix in the same release for CVE-2025-66446, a permission bypass caused by system file overwriting, which is a good reason not to stop at partial patches.
How to check if you're exposed
Check your running version in the product UI, or look at the container image tag.
docker ps --format "table {{.Names}}\t{{.Image}}"
If the tag is 2.3.1 or lower, you are affected. Then list who can create or edit tools in your MaxKB workspaces. Anyone who can run custom tool code is the audience for this flaw.
What to do now
- Upgrade MaxKB to 2.4.0 or later, which also carries the fix for CVE-2025-66446.
- Limit who can create and run custom tools, and remove accounts you do not need.
- Run the container with the fewest privileges it needs, with no host mounts and no cloud credentials in its environment.
- Review tool definitions and execution logs for code your team did not write.
- Take inventory of the AI platforms you run. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The class is CWE-362, a race condition from improper synchronization of a shared resource. The advisory says only that the tool module allows sandbox escape under certain concurrent conditions, and we do not guess beyond that. A race means two operations at once can leave the system in a state the code never expected, and here the result is that a guard stops holding.
Platforms that run user supplied tool code depend on the sandbox as the main boundary. When that boundary has a timing gap, a low privileged user can reach the host. The record does not mark this as exploited in the wild, and it is not on CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does the release say about the fix?
The v2.4.0 notes list a fix for a permission bypass under specific concurrent conditions and name CVE-2025-66419.
Who can use this?
An account that can run tools, according to the record vector, which lists low privileges.
Sources
Last reviewed: 18 October 2026.
