CVE-2026-77522— MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
Quick assessment
Affected
1Panel-dev MaxKB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and with
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 1Panel-dev | MaxKB | <= 2.10.3-lts |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77522
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
Source: CVE Program / CVE List V5
Vulnerability Description
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 1Panel-dev | MaxKB | <= 2.10.3-lts | - |
|
II. Public POCs for CVE-2026-77522
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77522
请登录查看更多情报信息。
Other References for CVE-2026-77522 (1)
Same Patch Batch · 1Panel-dev · 2026-09-21 · 13 CVEs total
| CVE-2026-77521 | 10.0 CRITICAL | MaxKB: Prompt-injectable agent can lead to command execution |
| CVE-2026-79916 | 9.1 CRITICAL | MaxKB AWS Bedrock model credential injection leads to remote code execution |
| CVE-2026-77523 | 7.4 HIGH | MaxKB: Cross-workspace model parameter form write |
| CVE-2026-79917 | 6.5 MEDIUM | MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user |
| CVE-2026-79919 | 6.3 MEDIUM | MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path c |
| CVE-2026-79918 | 6.3 MEDIUM | MaxKB: Sandbox escape via unhooked fexecve |
| CVE-2026-77520 | 5.4 MEDIUM | MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to i |
| CVE-2026-77517 | 5.4 MEDIUM | MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in |
| CVE-2026-77516 | 5.4 MEDIUM | MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path |
| CVE-2026-77519 | 5.4 MEDIUM | MaxKB: Expired application API keys remain usable on `/chat/api/mcp` |
| CVE-2026-77518 | 5.0 MEDIUM | MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflo |
| CVE-2026-77525 | 4.2 MEDIUM | MaxKB: Management chat-record routes trust path application_id but load ChatRecord by glob |
IV. Related Vulnerabilities
Same product: MaxKB
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-79917
MaxKB: Chat share-link endpoint missing owner check: a chat
Same vendor: 1Panel-dev
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-79917
MaxKB: Chat share-link endpoint missing owner check: a chat
Same weakness: CWE-918
-
CVE-2026-16426
Multiple Vulnerabilities in IBM Concert Software -
CVE-2026-77987
GitHub Enterprise Server notebook viewer vulnerable to Serve -
CVE-2026-96259
Mattermost server-side request forgery via OAuth endpoints c -
CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery -
CVE-2026-84395
Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)
V. Comments for CVE-2026-77522
No comments yet