CVE-2026-45412
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
MaxKB prior to version 2.9.1 is vulnerable to SSRF (Server-Side Request Forgery) via work_flow_template import. Authenticated users can supply arbitrary URLs in work_flow_template.downloadUrl which are fetched server-side without any URL validation or internal IP filtering.
Risk Assessment
An attacker could use the server to scan internal networks, access internal resources, or launch attacks against other systems.
Recommendation
Update MaxKB to version 2.9.1 or later.
Other vulnerabilities in MaxKB
See all- CVE-2026-64870Medium
MaxKB from version 2.0.0 to 2.10.4-lts in UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url to requests.get without trusted-host and redirect validation. An authenticated workspace user can make the server request internal, loopback, link-local, or cloud metadata URLs.
- CVE-2026-54149High
In MaxKB prior to 2.10.0-lts, the tool import functionality and MCP referencing mode do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file with stdio transport containing malicious commands and trigger execution via an AI Chat node, leading to arbitrary system command execution.
- CVE-2026-56779Medium
An SSRF vulnerability in MaxKB before version 2.10.0 allows authenticated users to make arbitrary server requests via unvalidated downloadCallbackUrl and download_url parameters in tool creation and update endpoints. Attackers with the default USER role can exploit this to access internal network services.
- CVE-2026-45413Medium
MaxKB stores user passwords using unsalted MD5 hashes, making them easily crackable via rainbow tables or GPU-accelerated brute force.
- CVE-2026-44847High
MaxKB before version 2.9.0 exposes the webhook endpoint (/api/trigger/v1/webhook/{trigger_id}) without authentication. The WebhookAuth class returns (None, {}), which is interpreted as successful authentication. An unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute bound tasks.
- CVE-2026-42337Medium
MaxKB version 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url). The endpoint uses application_id from the URL path without validating ownership, allowing attackers to perform operations under other applications’ policies.
- CVE-2026-42336Medium
MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services.
- CVE-2026-42335Medium
MaxKB before version 2.8.1 is vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch endpoint. Inconsistent URL parsing between the validation function and the HTTP client allows attackers to access internal network services.
Original NVD description (English source)
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary URLs in work_flow_template.downloadUrl which are fetched server-side without any URL validation or internal IP filtering. This vulnerability is fixed in 2.9.1.