Skip to content
Sign in
5.3 Medium

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

Description

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Confidentiality of other systems
Low
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
MaxKB 2.10 earliest → < 2.10.0 2.10.0

Other CVEs of MaxKB

The 47 CVEs of MaxKB →
CVE-2026-79919 MaxKB is an open-source AI assistant for enterprise 6.3 Medium CVE-2026-79918 MaxKB is an open-source AI assistant for enterprise 6.3 Medium CVE-2026-77517 MaxKB is an open-source AI assistant for enterprise 5.4 Medium CVE-2026-77521 MaxKB is an open-source AI assistant for enterprise 10.0 Critical
Track this CVE