MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect

The core of this vulnerability lies in the ToolExecutor component's improper handling of Python's ctypes library. Attackers can leverage ctypes to directly invoke kernel system calls, effectively circumventing the sandbox enforced by the LD_PRELOAD-based sandbox.so module. This bypass grants attackers the ability to execute arbitrary code within the container, potentially leading to complete container compromise. The attacker can exfiltrate sensitive data from the network and gain control over the underlying system. This is particularly concerning given MaxKB's intended use within enterprise environments, where it may have access to sensitive data and critical infrastructure.

Organizations deploying MaxKB as an AI assistant within their enterprise environments are at risk. Specifically, deployments that grant workspace privileges to users who are not thoroughly vetted or who have access to sensitive data are particularly vulnerable. Shared hosting environments utilizing MaxKB also pose a higher risk due to the potential for cross-tenant exploitation.

• python: Monitor Python processes for unusual activity, especially those using ctypes and interacting with system calls. Use ps or top to identify suspicious processes.

ps aux | grep ctypes

• linux / server: Examine system logs (e.g., /var/log/syslog, /var/log/audit/audit.log) for calls to execve, system, connect, and open originating from Python processes within the MaxKB workspace.

journalctl -u maxkb -g 'system call'

• generic web: Monitor network traffic for unusual outbound connections from the MaxKB container to external hosts, particularly on non-standard ports.

curl -v <container_ip>:<port>

1. 2026-04-14Disclosure

   disclosure

1. Reserviert2026-04-07
2. Veröffentlicht2026-04-14
3. EPSS aktualisiert2026-04-21

The primary mitigation for CVE-2026-39421 is to immediately upgrade MaxKB to version 2.8.0 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing stricter workspace privilege controls to limit the potential impact of a successful exploit. While not a complete solution, restricting the attacker's ability to execute code within the workspace can reduce the blast radius. Monitor network traffic for unusual outbound connections originating from MaxKB containers. Review and harden the underlying container environment to minimize the potential for lateral movement if the container is compromised.