CVE-2026-42335: MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch (chat/api/oss/geturl) endpoint. The vulnerability exists due to inconsistent URL parsing between the urlparse validation function and the requests HTTP client, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxKB OSSto a version that resolves this vulnerability.Fixed in 2.8.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42335?
CVE-2026-42335 has a risk rating of 62, indicating a medium severity level.
How do I fix CVE-2026-42335?
To fix CVE-2026-42335, update MaxKB to version 2.8.1 or later.
What type of vulnerability is CVE-2026-42335?
CVE-2026-42335 is identified as a server-side request forgery (SSRF) vulnerability.
When was CVE-2026-42335 published?
CVE-2026-42335 was published on May 26, 2026.
What products are affected by CVE-2026-42335?
CVE-2026-42335 affects MaxKB versions 2.8.0 and earlier.