EUVD-2026-39527
GHSA-395g-c5fv-7hfh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring low-privilege authentication (PR:L); scope change (S:C) because internal systems beyond the vulnerable application are reachable via the server-side request; no integrity or availability impact on either the vulnerable or subsequent system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.
AnalysisAI
Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role to coerce the application server into making arbitrary HTTP requests to attacker-controlled destinations via the downloadCallbackUrl and download_url parameters on ToolSerializer endpoints. An attacker can pivot through the MaxKB host to probe and extract data from internal network services - cloud metadata APIs, internal databases, adjacent microservices - that would otherwise be inaccessible from outside the network perimeter. A public proof-of-concept exists at GitHub issue #6272; this is not confirmed actively exploited (not in CISA KEV).
Technical ContextAI
MaxKB (CPE: cpe:2.3:a:1panel-dev:maxkb:*:*:*:*:*:*:*:*) is an open-source Django/Django REST Framework AI knowledge-base platform developed by 1Panel-dev. The vulnerability class is CWE-918 (Server-Side Request Forgery): the ToolSerializer endpoints for tool creation and update accept downloadCallbackUrl and download_url parameters and issue server-side HTTP requests to those URLs without validating them against allowlists or blocking RFC-1918 and link-local address ranges. Because the request originates from the server process rather than the client browser, network-layer controls protecting the internal environment from external clients do not apply. The commit diff at 6c156afc656afa62ea4280e504a06ac1c9696b36 shows code reorganization in application.py; the primary SSRF fix targeting URL validation in ToolSerializer is expected in additional files within the same commit not fully shown in the provided diff.
RemediationAI
Upgrade MaxKB to version 2.10.0 or later, which incorporates the fix at commit 6c156afc656afa62ea4280e504a06ac1c9696b36 (https://github.com/1Panel-dev/MaxKB/commit/6c156afc656afa62ea4280e504a06ac1c9696b36). The VulnCheck advisory is at https://www.vulncheck.com/advisories/maxkb-server-side-request-forgery-via-downloadcallbackurl-and-download-url-parameters. As compensating controls prior to patching, restrict the MaxKB server's outbound egress using host-based firewall rules or cloud security groups to block requests to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16, particularly the cloud metadata endpoint 169.254.169.254); note that overly broad egress blocking may break legitimate external tool download functionality and should be scoped carefully. Additionally, restrict the USER role's ability to create or update tools to only trusted accounts where operationally feasible, reducing the exposed attack surface until the patch is applied.
MaxKB prior to version 1.10.8-lts contains an incomplete sandbox implementation that only blacklists binary execution in
OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated
Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke we
Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to
Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript thr
MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based s
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by expl
Server-side request forgery in MaxKB v2.8.0 and earlier allows authenticated low-privilege users to reach internal netwo
Server-Side Request Forgery in MaxKB before 2.9.1 allows authenticated users to pivot into internal network infrastructu
OS command injection in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to execute arbitrary
Cross-site scripting (XSS) in 1Panel-dev MaxKB up to version 2.4.2 allows authenticated remote attackers to inject malic
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today