CVE-2026-14784: vxcontrol PentAGI RCE Vulnerability

CVE-2026-14784 Overview

CVE-2026-14784 affects vxcontrol PentAGI versions up to 2.1.0. The vulnerability resides in an unspecified function within backend/pkg/docker/client.go, part of the Docker API component. Manipulation of this function leads to a sandbox issue, classified under [CWE-264] Permissions, Privileges, and Access Controls. Remote attackers with low privileges can initiate the attack over the network without user interaction. A pull request to remediate the flaw was submitted upstream and awaits acceptance at the time of publication.

Critical Impact
Authenticated remote attackers can abuse the Docker API client to escape or weaken sandbox boundaries in PentAGI, affecting confidentiality, integrity, and availability at a limited level.

Affected Products

vxcontrol PentAGI versions through 2.1.0
Component: Docker API interface (backend/pkg/docker/client.go)
Deployments exposing the PentAGI backend over the network

Discovery Timeline

2026-07-06 - CVE-2026-14784 published to the National Vulnerability Database
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14784

Vulnerability Analysis

PentAGI is an autonomous penetration-testing agent that orchestrates tooling inside Docker containers. The Docker API client implemented in backend/pkg/docker/client.go is responsible for creating, managing, and interacting with these containers. CVE-2026-14784 describes a sandbox issue in this client, meaning the isolation boundary between the agent host and the container workloads is not enforced as expected.

The vulnerability is classified as [CWE-264], indicating improper handling of permissions and access controls in the Docker client logic. An authenticated remote user can influence the Docker API invocation path to obtain capabilities beyond the intended sandbox. Impact scores across confidentiality, integrity, and availability are rated Low, consistent with restricted but real cross-boundary access.

Root Cause

The root cause is insufficient restriction of Docker API operations invoked by the backend. Container runtime interactions are exposed without adequate validation, allowing a caller to influence container configuration, mounts, or execution context. This weakens the security boundary that a sandbox is designed to enforce between untrusted agent-executed code and the surrounding infrastructure.

Attack Vector

The attack vector is network-based with low attack complexity and low privileges required. An attacker holding a valid low-privilege session against the PentAGI backend sends crafted requests that route through the vulnerable Docker client path. No user interaction is required. Successful exploitation can be used to weaken container isolation and access resources outside the intended sandbox scope.

Because no verified proof-of-concept has been published, technical exploitation details are described in prose only. Consult the GitHub Issue Tracker and the GitHub Pull Request for upstream discussion of the fix.

Detection Methods for CVE-2026-14784

Indicators of Compromise

Unexpected Docker API calls originating from the PentAGI backend to create privileged containers or bind sensitive host paths
New or modified containers with host filesystem mounts (/, /var/run/docker.sock, /etc) that were not part of standard PentAGI task workflows
Processes spawned by container runtimes with unusual parent chains tied to the PentAGI service account

Detection Strategies

Audit dockerd and container runtime logs for API requests that deviate from expected PentAGI task templates
Instrument the PentAGI host with runtime security tooling that alerts on container escape primitives, such as writes to /proc/*/exe or use of CAP_SYS_ADMIN
Correlate authentication events on the PentAGI backend with subsequent Docker API activity to identify low-privilege accounts triggering container operations

Monitoring Recommendations

Enable Docker daemon audit logging and forward events to a central analytics platform for retention and query
Monitor egress from PentAGI containers for connections to internal management interfaces or cloud metadata endpoints
Track version and build metadata of deployed PentAGI instances to confirm patch adoption once upstream merges the fix

How to Mitigate CVE-2026-14784

Immediate Actions Required

Restrict network access to the PentAGI backend so only trusted operators can authenticate
Review and reduce the privileges of any accounts capable of submitting tasks to PentAGI
Run the PentAGI backend under a dedicated, minimally scoped Docker context rather than the root Docker socket where possible

Patch Information

No released version currently addresses CVE-2026-14784. The upstream fix is tracked in GitHub Pull Request #355 and remains pending acceptance. Operators should monitor the PentAGI repository and the VulDB CVE Entry for updates, then upgrade as soon as a patched release is published.

Workarounds

Deploy PentAGI behind a reverse proxy that enforces strong authentication and source-IP allowlisting
Isolate the PentAGI host in a dedicated network segment with strict egress controls to limit lateral movement if the sandbox is bypassed
Use rootless Docker or a container runtime with user namespace remapping to reduce the impact of a sandbox escape
Apply seccomp, AppArmor, or SELinux profiles to constrain container capabilities beyond Docker defaults

bash

# Configuration example: constrain the Docker daemon used by PentAGI
# /etc/docker/daemon.json
{
  "userns-remap": "default",
  "no-new-privileges": true,
  "icc": false,
  "live-restore": true,
  "default-ulimits": {
    "nofile": { "Name": "nofile", "Hard": 4096, "Soft": 1024 }
  }
}

# Restart the daemon after applying changes
sudo systemctl restart docker