Medium severity · published Sep 21, 2026
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym with RTLD_NEXT to resolve glibc's real syscall and bypass the sandbox syscall blacklist. An authenticated workspace member can consequently read or write files, execute processes, or access networks as the sandbox user. This issue is fixed in version 2.10.6-lts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MaxKB · 1Panel-dev
< 2.10.6-lts · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79919
github.com
https://github.com/1Panel-dev/MaxKB/commit/d4bd22af8ba14a9dea317f9034332fec4e964697
github.com
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.6-lts
github.com
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-6h35-c779-4v37
More from MaxKB
10.0
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution
10.0
CVE-2025-66419
MaxKB vulnerable to privilege escalation through sandbox bypass
9.8
CVE-2025-53928
MaxKB has RCE in MCP call
9.1
CVE-2026-79916
MaxKB AWS Bedrock model credential injection leads to remote code execution
8.8
CVE-2026-54149
MaxKB MCP tool import validation bypass allows post-authentication remote code execution