CVE-2026-18593: vxcontrol PentAGI RCE Vulnerability

CVE-2026-18593 Overview

CVE-2026-18593 is a sandbox weakness in vxcontrol PentAGI versions up to 2.1.0. The flaw resides in the Tool Management Protocol Handler, specifically within the backend/pkg/templates/prompts/pentester.tmpl file. Manipulation of this component can break the intended sandbox boundary of the pentester agent workflow. The issue is remotely reachable but exploitation carries high complexity. A public exploit has been released, and the vendor did not respond to disclosure attempts. The vulnerability is categorized under [CWE-264] (Permissions, Privileges, and Access Controls).

Critical Impact
Remote attackers who successfully bypass the sandbox may influence tool execution within the PentAGI agent, affecting confidentiality, integrity, and availability at a limited scope.

Affected Products

vxcontrol PentAGI 2.0.x
vxcontrol PentAGI 2.1.0
All prior 2.x releases with the affected pentester.tmpl template

Discovery Timeline

2026-08-03 - CVE-2026-18593 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18593

Vulnerability Analysis

PentAGI is an autonomous AI-driven penetration testing agent that executes tools inside a controlled sandbox. The Tool Management Protocol Handler orchestrates which commands the agent may invoke and constrains their execution context. The prompt template at backend/pkg/templates/prompts/pentester.tmpl defines the instructions that shape tool selection and execution boundaries. A crafted input can influence how the handler interprets these instructions, allowing operations outside the sandbox model. Exploitation requires attacker skill to align inputs with the template logic, which is reflected in the low base score. Impact remains bounded to the agent scope, but public proof-of-concept availability increases exposure for exposed deployments.

Root Cause

The root cause is insufficient enforcement of privilege and execution boundaries in the pentester prompt template combined with the Tool Management Protocol Handler. Trust in template-supplied directives permits sandboxed logic to be steered by manipulated input, breaking the isolation contract the handler is expected to enforce.

Attack Vector

A remote attacker interacts with the PentAGI agent through its normal network-facing interface. By crafting inputs that reach the tool management pipeline, the attacker manipulates prompt template evaluation. Successful manipulation causes the handler to execute or authorize actions the sandbox should have blocked. No authentication or user interaction is required, but attack complexity is high because the payload must survive template processing. Technical details are documented in the GitHub Vulnerability Report and VulDB CVE-2026-18593 entry.

Detection Methods for CVE-2026-18593

Indicators of Compromise

Unexpected tool invocations logged by the Tool Management Protocol Handler that do not match legitimate operator-initiated pentest tasks.
Outbound network connections from the PentAGI container or host targeting destinations outside the intended engagement scope.
Anomalous modifications or reads of backend/pkg/templates/prompts/pentester.tmpl at runtime.

Detection Strategies

Enable verbose logging on the Tool Management Protocol Handler and alert on tool-call sequences that deviate from established baselines.
Deploy runtime application behavior monitoring on the PentAGI process to flag command execution originating from prompt-driven paths.
Correlate agent prompts, tool selections, and process executions to identify manipulated instructions bypassing sandbox controls.

Monitoring Recommendations

Monitor process creation and network egress from the PentAGI host with an EDR platform mapped to MITRE ATT&CK techniques for command execution and privilege abuse.
Track integrity of prompt template files using file-integrity monitoring and alert on unauthorized modification.
Review agent transcripts for anomalous instruction patterns targeting the pentester template.

How to Mitigate CVE-2026-18593

Immediate Actions Required

Restrict network exposure of PentAGI instances to trusted operator networks or VPN-gated segments only.
Audit recent tool-execution logs on affected PentAGI deployments for signs of sandbox escape or unauthorized command execution.
Remove or rotate any credentials, API keys, and cloud tokens that were accessible to the PentAGI agent host.

Patch Information

No vendor-supplied patch has been announced. VulDB records indicate the vendor was contacted early during disclosure but did not respond. Track the GitHub Vulnerability Report and VulDB Vulnerability #385421 for updates.

Workarounds

Run PentAGI inside a hardened container with strict seccomp, AppArmor, or SELinux profiles that limit tool execution to an allowlist.
Apply network egress filtering so the agent cannot reach unintended targets even if the sandbox model is bypassed.
Disable or restrict the pentester tool profile where the pentester.tmpl template is not required for current engagements.
Isolate PentAGI on a dedicated host with no access to production secrets or identity infrastructure.

bash

# Example egress restriction using iptables to limit PentAGI container reachability
iptables -I DOCKER-USER -s <pentagi_container_ip> -d <engagement_target_cidr> -j ACCEPT
iptables -I DOCKER-USER -s <pentagi_container_ip> -j DROP