CVE-2026-47128: Nono Privilege Escalation Vulnerability

CVE-2026-47128 Overview

CVE-2026-47128 is a sandbox escape vulnerability in nono, software that runs AI agents in a zero-latency sandbox. The Landlock and seccomp policies enforced by nono prior to version 0.55.0 allow access to local Unix domain sockets, including both concrete and abstract namespaces. An attacker with local access inside the sandbox can communicate with the per-user systemd D-Bus socket to escape confinement. The issue is classified under CWE-863: Incorrect Authorization. Version 0.55.0 remediates the issue by restricting socket access in the sandbox policy.

Critical Impact
A confined AI agent process can escape the nono sandbox by invoking systemd services over the user D-Bus socket, undermining the isolation guarantees of the runtime.

Affected Products

nono (nolabs-ai) versions prior to 0.55.0
Deployments relying on nono Landlock/seccomp policies for AI agent isolation
Linux hosts running per-user systemd with D-Bus session bus enabled

Discovery Timeline

2026-07-20 - CVE-2026-47128 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47128

Vulnerability Analysis

nono provides a low-latency sandbox for executing AI agents on Linux hosts. It relies on Landlock (a Linux Security Module for unprivileged access control) and seccomp (secure computing mode syscall filtering) to constrain what a sandboxed process can do. In versions before 0.55.0, the policy authorizes connections to Unix domain sockets in both the filesystem-backed (concrete) and abstract namespaces.

Unix domain sockets are the primary IPC channel used by systemd and D-Bus on Linux. Because the sandbox permits socket access without brokering the destination, a confined process can connect to the per-user systemd D-Bus endpoint and issue method calls on behalf of the invoking user. That path leads directly to sandbox escape.

Root Cause

The root cause is an incorrect authorization decision in the sandbox policy [CWE-863]. Landlock and seccomp rules omit filtering for Unix domain socket connections, so the sandbox authorizes IPC to endpoints outside its trust boundary. The systemd user bus and other user-scoped services become reachable from within the confined process.

Attack Vector

The attack requires local access as a low-privilege user inside a nono sandbox and no user interaction. An adversary controlling an AI agent process opens a Unix socket connection to $XDG_RUNTIME_DIR/bus or an abstract systemd endpoint, then issues D-Bus method calls such as StartTransientUnit to run commands outside the sandbox with the invoking user's privileges. This yields high integrity impact while leaving confidentiality unchanged and availability partially affected.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-27vp-2mmc-vmh3 for the maintainer's technical description.

Detection Methods for CVE-2026-47128

Indicators of Compromise

Sandboxed nono agent processes opening connect() calls to $XDG_RUNTIME_DIR/bus or @/bus/systemd/ abstract sockets.
Unexpected systemd --user transient unit creation originating from an AI agent workload.
D-Bus method calls to org.freedesktop.systemd1.Manager.StartTransientUnit from processes launched inside a nono sandbox.

Detection Strategies

Audit connect(AF_UNIX) syscalls from nono agent PIDs using auditd or eBPF probes and alert on non-allowlisted socket paths.
Monitor systemd journal entries for user-scoped transient units spawned during agent execution windows.
Correlate process ancestry so any child of a nono runtime that spawns outside the sandbox cgroup is flagged.

Monitoring Recommendations

Deploy a Linux EDR sensor that records connect, sendmsg, and D-Bus activity from sandboxed workloads.
Enable systemd LogLevel=debug on the user bus in test environments to profile normal agent IPC before writing production rules.
Baseline the expected Unix socket destinations for nono workloads and alert on deviations.

How to Mitigate CVE-2026-47128

Immediate Actions Required

Upgrade all nono installations to version 0.55.0 or later without delay.
Inventory hosts running nono and restrict interactive user sessions on machines that cannot be patched immediately.
Disable the per-user systemd instance on hosts that do not require it by masking user@.service where operationally feasible.

Patch Information

Version 0.55.0 of nono updates the Landlock and seccomp policies to block access to concrete and abstract Unix domain sockets not required by the sandbox. Consult the nono GHSA-27vp-2mmc-vmh3 advisory for the full patch description and release notes.

Workarounds

Run nono under a dedicated system user that has no active systemd user instance and no D-Bus session bus.
Wrap the nono runtime in an additional namespace layer such as a user namespace or bwrap profile that removes access to $XDG_RUNTIME_DIR.
Apply an AppArmor or SELinux profile that denies unix socket connections to systemd and D-Bus paths for the nono process tree.

bash

# Example: unset the runtime directory before launching nono to remove
# the default path to the per-user D-Bus socket
unset DBUS_SESSION_BUS_ADDRESS
unset XDG_RUNTIME_DIR
systemctl --user mask dbus.socket 2>/dev/null || true

# Verify the installed nono version is 0.55.0 or later
nono --version