A vulnerability in nono-py versions >=0.9.0 <0.10.1 allows sandboxed child processes on Linux kernels without Landlock network support to bypass proxy-only network restrictions. This occurs because the seccomp-notify proxy-only fallback is not supervised, enabling direct TCP connections that should be denied. The issue affects proxy-only enforcement on older Linux kernels prior to 6.7. The highest impact is unauthorized access to cloud metadata endpoints, potentially exposing credentials.