EUVD-2026-51201Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requiring low-privilege workspace auth (PR:L); scope changes to internal systems (S:C) via SSRF enabling limited confidentiality and integrity impact against internal hosts.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user to make the server request internal, loopback, link-local, or cloud metadata URLs. A fix is present on the v2 branch but has not yet been included in a published release.
AnalysisAI
Server-side request forgery in MaxKB versions 2.0.0 through 2.10.4-lts allows authenticated workspace users to proxy HTTP requests through the application server to internal infrastructure, loopback addresses, link-local networks, and cloud instance metadata endpoints such as the AWS IMDSv1 service. The vulnerable code paths in both template workflow handlers and tool update functions pass caller-supplied download_url and download_callback_url values directly to requests.get protected only by a weak startsWith prefix check, which is insufficient to block hostname-confusion or open-redirect bypasses. No public exploit has been identified at time of analysis, and the upstream fix on the v2 branch has not yet been packaged into a published release.
Technical ContextAI
MaxKB is an enterprise AI assistant platform built on Python/Django (CPE: cpe:2.3:a:1panel-dev:maxkb:*:*:*:*:*:*:*:*). The root cause (CWE-918: Server-Side Request Forgery) manifests in apps/application/serializers/application.py within the insert_template_workflow and update_template_workflow methods, and in apps/knowledge/serializers/knowledge_workflow.py within save_workflow. The original code validated URLs only with a startsWith check against the literal string 'https://apps-assets.fit2cloud.com/' or 'https://apps.fit2cloud.com/', which fails to prevent bypass via crafted subdomains (e.g., apps-assets.fit2cloud.com.evil.com), userinfo injection, or redirect chains since allow_redirects defaulted to True. The fix, visible in commit a96a4fc17051d80e5b90a632ad8ec851d7d24b58, introduces a validate_trusted_url function with strict hostname allowlisting (ALLOWED_DOWNLOAD_HOSTS and ALLOWED_CALLBACK_HOSTS as exact sets), HTTPS-only enforcement, rejection of userinfo fields and explicit ports, and sets allow_redirects=False on all outbound requests.get calls.
RemediationAI
No patched release has been published at time of analysis; the fix exists only as upstream commit a96a4fc17051d80e5b90a632ad8ec851d7d24b58 on the v2 branch and has not been included in any tagged release - monitor https://github.com/1Panel-dev/MaxKB/releases for a patched build and apply it immediately upon availability. As the primary compensating control, restrict MaxKB server outbound HTTP/HTTPS egress using host-based firewall or cloud security group rules to permit traffic only to apps-assets.fit2cloud.com and apps.fit2cloud.com on port 443, and explicitly block access to 127.0.0.0/8 (loopback), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (RFC 1918), and 169.254.0.0/16 (link-local and cloud metadata); this neutralizes the SSRF reach without modifying application code, though it may break legitimate integrations that route through non-standard hosts. On AWS, enforce IMDSv2 (requiring a PUT-based session token) on all EC2 instances hosting MaxKB, which prevents credential theft via the metadata endpoint even if SSRF is triggered. Limit workspace user provisioning to trusted personnel to reduce the authenticated attack surface. The advisory is at https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-7xxm-gqxv-ph3v.
MaxKB prior to version 1.10.8-lts contains an incomplete sandbox implementation that only blacklists binary execution in
Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role
OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated
Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke we
Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to
Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript thr
MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based s
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by expl
Server-side request forgery in MaxKB v2.8.0 and earlier allows authenticated low-privilege users to reach internal netwo
Server-Side Request Forgery in MaxKB before 2.9.1 allows authenticated users to pivot into internal network infrastructu
OS command injection in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to execute arbitrary
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today