Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym with RTLD_NEXT to resolve glibc's real syscall and bypass the sandbox syscall blacklist. An authenticated workspace member can consequently read or write files, execute processes, or access networks as the sandbox user. This issue is fixed in version 2.10.6-lts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-21T21:17:12.937Z",
  "pubdate": "2026-09-21T21:17:12.937Z",
  "executiveSummary": "MaxKB versions prior to 2.10.6-lts contain a critical security vulnerability that allows an authenticated attacker to bypass the LD_PRELOAD-based syscall sandbox. This bypass is achieved by manipulating the dlopen call-stack heuristics within the Python runtime, specifically targeting the interaction between importlib.abc.MetaPathFinder and the ctypes.CDLL foreign function interface.\nThe vulnerability enables an authenticated workspace member to execute arbitrary system calls that are otherwise restricted by the sandbox. Successful exploitation grants the attacker the ability to perform unauthorized file system operations (read/write), execute arbitrary OS processes, and establish unauthorized network connections.\nThe risk is high, as the sandbox is intended to isolate AI-generated function-library code from the underlying host environment. By leveraging RTLD_NEXT to resolve the base addresses of glibc functions, the attacker effectively renders the sandbox security controls null, leading to a complete compromise of the sandbox user's context.",
  "technicalDetails": "The vulnerability resides in the way the sandbox restricts syscall access within function-library code executed by MaxKB. The sandbox mechanism relies on an LD_PRELOAD hook to intercept and validate sensitive system calls. However, the implementation is susceptible to a call-stack heuristic bypass.\nThe attack flow begins when an authenticated attacker uploads or triggers malicious function-library code. The attacker utilizes an importlib.abc.MetaPathFinder callback within the Python environment. By invoking ctypes.CDLL from within this specific callback, the attacker forces the dynamic linker to perceive the call stack as originating from a legitimate Python import operation rather than the sandboxed function code. This misdirection confuses the sandbox’s heuristic checks, which are designed to differentiate between secure and malicious call origins.\nOnce the heuristic is bypassed, the attacker utilizes unhooked dlsym calls with the RTLD_NEXT flag. Since the standard glibc functions are hooked by the sandbox to perform validation, using RTLD_NEXT allows the attacker to obtain the memory address of the actual, unhooked glibc implementation of the desired syscall (e.g., execve, open, or connect).\nBecause the raw syscalls are accessed directly, the sandbox’s blacklist/validation logic is never reached. The attacker can then invoke these resolved syscalls directly via ctypes, bypassing all imposed security constraints. This effectively grants the attacker the full permissions of the user account running the sandbox process.\nThis vulnerability is particularly dangerous because it exploits the inherent design of Python's dynamic extension loading and the limitations of LD_PRELOAD-based sandbox implementations when interacting with foreign function interfaces (FFI). It does not rely on a logical error in the blacklist itself, but rather on the ability to evade the interception mechanism entirely. The impact is a full Sandbox Escape, enabling unrestricted interaction with the host operating system, local file systems, and network interfaces, as long as the underlying process has the necessary permissions.\nAffected components include any execution environment within MaxKB that utilizes LD_PRELOAD to restrict function library behavior. The issue is confirmed in all versions prior to 2.10.6-lts."
}