MaxKB CVE-2026-64870

Exploitation requires a valid authenticated workspace user session within MaxKB - the CVSS PR:L metric confirms this; unauthenticated external attackers cannot exploit this vulnerability. The vulnerable code paths are triggered through the tool update and template workflow import functionality (UpdateStoreTool.update_tool, insert_template_workflow, update_template_workflow, save_workflow), which are part of standard MaxKB application and knowledge management features requiring no special non-default configuration to activate. Exploitation is further limited by the MaxKB host's network egress policy: if the server cannot reach internal subnets, loopback, or cloud metadata endpoints (169.254.169.254) due to firewall rules or cloud security group restrictions, the SSRF pivot fails to reach sensitive targets. Response reflection behavior in some code paths (callback URLs) may be indirect, limiting exfiltration in those cases to side-channel or DNS-based techniques rather than direct data return.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) accurately reflects the threat model: low-complexity, network-accessible exploitation requiring only a workspace-level authenticated session, with impact limited to subsequent systems rather than MaxKB itself. The SC:L/SI:L subsequent-system metrics confirm that internal infrastructure - cloud metadata services, internal APIs, and RFC 1918 hosts - is the primary risk target. No EPSS data was provided in the input; no CISA KEV listing exists; no public POC has been identified, keeping this below immediate emergency priority. The authenticated requirement (PR:L) meaningfully constrains the attack surface to insider threats or compromised workspace accounts. Real-world risk is elevated for cloud-deployed MaxKB instances that rely on IMDSv1 metadata endpoints, where a successful SSRF could yield short-lived IAM credentials. On-premises deployments behind strict network egress controls face substantially reduced risk. The absence of a patched release as of disclosure is the most operationally urgent signal: no upgrade path exists, requiring reliance on compensating controls.

An authenticated MaxKB workspace user submits a tool update request supplying a download_url value of http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name targeting the AWS instance metadata service; the MaxKB server issues the GET request server-side and the response containing IAM role credentials is available to the attacker via application behavior or error messages. Alternatively, a crafted URL like https://apps-assets.fit2cloud.com.attacker.com/ could bypass the original startsWith check, directing the server to an attacker-controlled host. No public POC has been identified at time of analysis.