CVE-2026-56779: MaxKB Server-Side Request Forgery (SSRF) in Tool Endpoints

Technical summary

The vulnerability exists in the ToolSerializer endpoints responsible for tool creation and update operations. The downloadCallbackUrl and download_url parameters accept user input without proper validation or allowlisting. When these parameters are processed, the server performs HTTP requests to the supplied URLs without confirming they point to legitimate external resources. An attacker with USER role permissions in the default workspace can supply internal IP addresses (e.g., 127.0.0.1, 192.168.x.x) or hostnames pointing to internal services, causing the MaxKB server to make requests on their behalf. This grants access to services that would normally be isolated from untrusted networks.

Business impact

The exposure is significant for organizations using MaxKB in networked environments where the application server has access to internal systems. An insider threat or compromised low-privilege account can map and interact with internal infrastructure—potentially accessing configuration endpoints, metadata services, database admin consoles, or other backend services. Depending on the internal network topology and what services are accessible from the MaxKB server, this could lead to reconnaissance of critical assets, credential theft via metadata endpoints, or lateral movement. The requirement for authentication limits exposure to users with legitimate system access, but that authentication can be obtained through credential compromise, phishing, or insider action.

Affected systems

MaxKB versions prior to 2.10.0 are vulnerable. The vendor information provided does not include specific version breakpoints or a list of patched releases beyond the minimum affected version. Organizations must consult MaxKB's official security advisory and release notes to identify all patched versions available in their deployment channel. The vulnerability affects the tool management subsystem, so environments actively using the tool creation or update features face the highest risk.

Exploitability

Exploitation requires valid authentication credentials with USER role or higher in a MaxKB workspace. No authentication bypass is needed; the flaw assumes an attacker has already gained or possesses legitimate credentials. The attack surface is straightforward: the attacker simply submits a tool creation or update request with a malicious URL in the downloadCallbackUrl or download_url field. No user interaction is required, and the network requirement is only that the attacker can reach the MaxKB server itself. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) reflects low complexity and the ability to impact resources outside the vulnerable component via network access, though impact is limited to information disclosure and limited modification.

Remediation

Upgrade MaxKB to version 2.10.0 or later. The patch version should include validation and allowlisting logic for the downloadCallbackUrl and download_url parameters. Before patching, restrict workspace access to trusted personnel and monitor for suspicious tool creation or update activities, particularly those referencing internal IP ranges or hostnames.

Patch guidance

Apply MaxKB version 2.10.0 or any subsequent release that includes the SSRF remediation. Verify the patch notes confirm that downloadCallbackUrl and download_url parameters are now validated against an allowlist or are constrained to external resources only. Test the patch in a non-production environment first to ensure compatibility with existing tool configurations. After patching, audit existing tools to identify any that may have been created with internal URLs and remove or remediate them.

Detection guidance

Monitor HTTP request logs and network traffic from the MaxKB server process for outbound connections to unusual or internal destinations (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, or hostnames matching internal naming conventions). Inspect application audit logs for tool creation or update events followed by failed or unusual requests. Search for tool records where downloadCallbackUrl or download_url contain internal IP addresses or reserved hostnames. Configure network segmentation to limit the MaxKB server's ability to reach internal services it should not contact, and use firewall rules to restrict outbound traffic to approved external endpoints only.

Why prioritize this

Although the CVSS score is MEDIUM (6.4), the vulnerability should not be deprioritized. It requires authentication, which significantly limits casual exploitation, but insider threats and credential compromise are realistic attack vectors. The ability to access internal services from a compromised or malicious authenticated user could expose sensitive infrastructure. Organizations in defense-in-depth postures or those with strict internal network segmentation will see lower practical risk, while those with flat networks or legacy systems accessible from the application tier should prioritize patching sooner.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects: Network-accessible vector (AV:N) acknowledging the attack must traverse the network; Low complexity (AC:L) because no special conditions are needed once authenticated; Privilege required (PR:L) enforcing the authentication gate; No user interaction (UI:N); Scope changed (S:C) meaning the vulnerability can affect resources outside the vulnerable component; Confidentiality impact of Low (C:L) from accessing internal service responses; Integrity impact of Low (I:L) from potential modification via internal service interaction; and No availability impact (A:N). The authentication requirement and limited impact prevent a higher rating, but the cross-boundary scope and network accessibility justify a MEDIUM severity.

Frequently asked questions