CVE-2026-39420 MaxKB: Sandbox escape via LD_PRELOAD bypass
Authenticated users can bypass the LD_PRELOAD sandbox by clearing environment variables, leading to unrestricted remote code execution and network access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39420?
CVE-2026-39420 is a medium-severity vulnerability in 1Panel-dev MaxKB, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LD_PRELOAD-based sandbox. By env command the attacker can clear the environment variables and drop the sandbox.so hook, leading to unrestricted Remote Code Execution (RCE) and network access. MaxKB restricts untrusted Python code execution via the Tool Debug API by injecting sandbox.so through the LD_PRELOAD environment variable. This intercepts sensitive C library functions (like execve, socket, open) to restrict network and file access. However, a patch allowed the /usr/bin/env utility to be executed by the sandboxed user. When an attacker is permitted to create subprocesses, they can execute the env -i python command. The -i flag instructs env to completely clear all environment variables before running the target program. This effectively drops the LD_PRELOAD environment variable. The newly spawned Python process will therefore execute natively without any sandbox hooks, bypassing all network and file system restrictions. This issue has been fixed in version 2.8.0.
Which versions are affected by CVE-2026-39420?
It affects 1 product.
Products include Maxkb Maxkb.
How do I fix CVE-2026-39420?
No fix has been published for CVE-2026-39420 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39420 being exploited?
There is no known exploitation of CVE-2026-39420 in the wild and no public exploit code.
Other vulnerabilities in 1Panel-dev MaxKB
- CVE-2025-66419 MaxKB vulnerable to privilege escalation through sandbox bypass
- CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass
- CVE-2025-64511 MaxKB has SSRF in sandbox
- CVE-2026-39422 MaxKB has Stored XSS via ChatHeadersMiddleware
- CVE-2026-39423 Stored XSS via Eval Injection in EchartsRander Component
Sources
Also known as GHSA-7wgv-v2r3-7f7w.