CVE-2026-56779
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An SSRF vulnerability in MaxKB before version 2.10.0 allows authenticated users to make arbitrary server requests via unvalidated downloadCallbackUrl and download_url parameters in tool creation and update endpoints. Attackers with the default USER role can exploit this to access internal network services.
Risk Assessment
The risk includes potential internal network scanning, access to sensitive data or services, and possible escalation of attacks against other internal systems within the organization.
Recommendation
Immediately upgrade MaxKB to version 2.10.0 or later, which includes a fix for the SSRF vulnerability. Additionally, consider restricting user permissions and implementing server-side URL validation.
Other vulnerabilities in MaxKB
See all- CVE-2026-64870Medium
MaxKB from version 2.0.0 to 2.10.4-lts in UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url to requests.get without trusted-host and redirect validation. An authenticated workspace user can make the server request internal, loopback, link-local, or cloud metadata URLs.
- CVE-2026-54149High
In MaxKB prior to 2.10.0-lts, the tool import functionality and MCP referencing mode do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file with stdio transport containing malicious commands and trigger execution via an AI Chat node, leading to arbitrary system command execution.
- CVE-2026-45413Medium
MaxKB stores user passwords using unsalted MD5 hashes, making them easily crackable via rainbow tables or GPU-accelerated brute force.
- CVE-2026-45412Medium
MaxKB prior to version 2.9.1 is vulnerable to SSRF (Server-Side Request Forgery) via work_flow_template import. Authenticated users can supply arbitrary URLs in work_flow_template.downloadUrl which are fetched server-side without any URL validation or internal IP filtering.
- CVE-2026-44847High
MaxKB before version 2.9.0 exposes the webhook endpoint (/api/trigger/v1/webhook/{trigger_id}) without authentication. The WebhookAuth class returns (None, {}), which is interpreted as successful authentication. An unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute bound tasks.
- CVE-2026-42337Medium
MaxKB version 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url). The endpoint uses application_id from the URL path without validating ownership, allowing attackers to perform operations under other applications’ policies.
- CVE-2026-42336Medium
MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services.
- CVE-2026-42335Medium
MaxKB before version 2.8.1 is vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch endpoint. Inconsistent URL parsing between the validation function and the HTTP client allows attackers to access internal network services.
Original NVD description (English source)
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.