CVE-2026-56779: MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxKBto a version that resolves this vulnerability.Fixed in 2.10.0 - Compensating control
Mitigate exploitation in MaxKB by preventing reachability of internal network services from the MaxKB server (e.g., restrict outbound network access from MaxKB so server-side requests triggered by downloadCallbackUrl/download_url cannot access internal endpoints).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56779?
The severity of CVE-2026-56779 is rated as medium with a score of 6.4.
What type of vulnerability is CVE-2026-56779?
CVE-2026-56779 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
How do I fix CVE-2026-56779?
To fix CVE-2026-56779, update MaxKB to version 2.10.0 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-56779?
Authenticated users with the default workspace USER role in MaxKB versions before 2.10.0 are affected by CVE-2026-56779.
What parameters are involved in CVE-2026-56779?
CVE-2026-56779 involves the unvalidated downloadCallbackUrl and download_url parameters in the tool creation and update endpoints.