Executive brief
MaxKB is an open-source AI assistant platform that executes untrusted code in a sandboxed environment. Prior to version 2.10.6-lts, an authenticated workspace member could bypass the sandbox's syscall restrictions by using ctypes and unhooked dlsym calls to directly invoke glibc functions, allowing them to read/write files, execute processes, or access networks as the sandbox user.
Technical details
The vulnerability exploits a flaw in the LD_PRELOAD sandbox's dlopen call-stack heuristic: an attacker can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen inspection sees a Python import frame, then use unhooked dlsym with RTLD_NEXT to resolve glibc's real syscall function and bypass the sandbox blacklist. This requires authentication as a workspace member. The vulnerability is patched in version 2.10.6-lts.
Affected products
- 1Panel MaxKB before 2.10.6-lts
Timeline
- 2026-09-21: disclosed
- 2026-09-03: patched