CVE-2026-77522 Details
Description
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.
A server-side request forgery (SSRF) vulnerability has been identified in MaxKB versions through 2.10.3-lts. The issue arises in the knowledge web-document import and synchronization crawler, which improperly handles user-supplied URLs. The crawler disables TLS verification and lacks restrictions on URL schemes or certain address types. This flaw allows low-privileged, authenticated users to access internal HTTP services or cloud metadata through the MaxKB server, potentially leading to unauthorized data exposure.
Users are advised to validate URLs before fetching them, allowing only 'http' or 'https' schemes, and to reject loopback, link-local, private, or reserved IP addresses. After resolving and validating the host, the URL should be re-checked post-redirects to prevent bypassing these safeguards. Additionally, removing the 'verify=False' option to restore TLS verification is crucial. Consider implementing an allow-list or using an egress proxy for crawler traffic.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-ffxw-frpx-8rww | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-ffxw-frpx-8rww | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MaxKB | <= 2.10.3-lts (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |