CVE-2026-39421: MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect

Vulnerability summary

CVE-2026-39421 is a high (CVSS 7.4) Improper Control of Generation of Code vulnerability in 1panel-dev maxkb. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 18.4% of scored vulnerabilities.

Timeline

1. 14-04-2026
   PublishedVulnerability first disclosed.
2. 14-04-2026
   Last modifiedVulnerability information updated.

Description

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnerability in the ToolExecutor component. By leveraging Python's ctypes library to execute raw system calls, an authenticated attacker with workspace privileges can bypass the LD_PRELOAD-based sandbox.so module to achieve arbitrary code execution via direct kernel system calls, enabling full network exfiltration and container compromise. The library intercepts critical standard system functions such as execve, system, connect, and open. It also intercepts mprotect to prevent PROT_EXEC (executable memory) allocations within the sandboxed Python processes, but pkey_mprotect is not blocked. This issue has been fixed in version 2.8.0.

• CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.