CVE-2026-42336: MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxKB OSS file service URL fetchto a version that resolves this vulnerability.Fixed in 2.8.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42336?
CVE-2026-42336 has a risk rating of 65, indicating a medium vulnerability severity.
How do I fix CVE-2026-42336?
To fix CVE-2026-42336, upgrade to MaxKB version 2.8.1 or later where the vulnerability has been addressed.
What does CVE-2026-42336 affect?
CVE-2026-42336 affects the MaxKB open-source AI assistant, specifically versions 2.8.0 and prior.
What is the main issue with CVE-2026-42336?
The main issue with CVE-2026-42336 is a server-side request forgery (SSRF) bypass caused by inconsistent DNS resolution.
How can attackers exploit CVE-2026-42336?
Attackers can exploit CVE-2026-42336 by leveraging the SSRF bypass to access internal services or sensitive information.