CVE-2026-14784: vxcontrol PentAGI Sandbox Escape via Docker API

Technical summary

CVE-2026-14784 is a sandbox escape vulnerability affecting vxcontrol PentAGI up to version 2.1.0. The issue resides in backend/pkg/docker/client.go, where the Docker API integration fails to properly enforce isolation boundaries. The vulnerability is classified under CWE-264 (improper use of privileges) and CWE-265 (incorrect privilege assignment), suggesting inadequate access control enforcement. An authenticated remote attacker can trigger the flaw to circumvent sandbox protections, achieving confidentiality, integrity, and availability impact within the scope of the running process. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the requirement for valid credentials and the limited scope of exploitation.

Business impact

The sandbox bypass creates operational and data protection risks for organizations running PentAGI, particularly in multi-tenant or containerized environments. Compromised user accounts or insider actors could access sensitive data processed within sandboxed containers, modify container configurations, or consume additional resources. For organizations relying on PentAGI's sandbox as a trust boundary for untrusted workloads or third-party integrations, this represents a material control gap until patched. Financial and compliance exposure depends on what sensitive data transits PentAGI and how the platform is architectured within your infrastructure.

Affected systems

vxcontrol PentAGI versions up to and including 2.1.0 are affected. Deployments relying on the sandbox feature for security or multi-tenancy isolation are at highest risk. The vulnerability requires an authenticated user session, so only systems exposed to authenticated users (internal networks, VPN access, or cloud deployments) face immediate risk.

Exploitability

Exploitation requires valid credentials; there is no unauthenticated attack path. An authenticated attacker with access to PentAGI can initiate the attack over the network without user interaction. The simplicity of the Docker API-level manipulation suggests moderate technical difficulty for an attacker with knowledge of the platform's internals. No public exploit code or proof-of-concept has been identified, and CISA has not added this to the Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active exploitation in the wild as of the publication date.

Remediation

Upgrade vxcontrol PentAGI to a patched version newer than 2.1.0 when available. Verify that the patch has been merged and released by the vendor; the source data indicates that the fix is pending acceptance in a pull request, so timing and availability should be confirmed directly with vxcontrol. In the interim, restrict network access to PentAGI to trusted users and networks, enforce multi-factor authentication for all user accounts, and monitor authenticated session activity for anomalies.

Patch guidance

Watch for a vxcontrol PentAGI release that supersedes version 2.1.0 and explicitly addresses sandbox isolation in the Docker client. Consult the vendor's official security advisories and release notes to confirm patch status before deployment. Test patches in a non-production environment to ensure compatibility with your workflow and dependent integrations. Once the patch is available and tested, prioritize it for production deployment within your standard change management windows.

Detection guidance

Monitor Docker API calls originating from PentAGI processes, particularly any attempts to escape or manipulate container namespaces or cgroup boundaries. Log and alert on privilege escalation attempts, unusual container escape sequences, or unauthorized access to host resources from within the PentAGI sandbox. Review audit logs for authentication anomalies (unusual login times, geographic inconsistencies, or rapid privilege grants). Intrusion detection systems tuned to container escape patterns may flag exploitation attempts.

Why prioritize this

Although classified as MEDIUM severity, this vulnerability warrants prompt attention because sandbox bypass vulnerabilities erode a fundamental trust boundary in containerized systems. The requirement for authentication limits immediate blast radius, but compromised or insider accounts become considerably more dangerous. Organizations using PentAGI in multi-tenant, cloud, or high-value data processing contexts should prioritize patching. Lower urgency is acceptable for isolated or air-gapped single-user deployments.

Risk score, explained

CVSS 3.1 score of 6.3 (MEDIUM) reflects: (1) network-accessible attack vector; (2) low complexity exploitation; (3) requirement for authenticated user privileges, which reduces the attack surface; (4) confidentiality, integrity, and availability impact all possible but confined to the security scope of the process. The absence of unauthenticated remote code execution and KEV listing prevents a higher score, but the direct sandbox escape and multi-impact nature justify the medium rating.

Frequently asked questions