CVE-2026-77522: MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated workspace user with low privileges can exploit it by supplying a URL to the knowledge web-document import or synchronization crawler. The request is made from the MaxKB server, so the user may be able to access services reachable only from that server.
What data or services could be exposed?
The crawler returns the fetched response body as imported document content, making this a non-blind SSRF. This can expose cloud metadata endpoints and internal HTTP services, including loopback, link-local, private, or reserved addresses.
Are deployments affected by default?
Affected versions use the web-document import and synchronization crawler without restrictions on URL schemes or internal address ranges. Exposure requires that authenticated workspace users can use that crawler functionality.
What can be done while no fixed version is available?
Restrict access to the knowledge web-document import and synchronization feature for untrusted or low-privileged users. Limit the MaxKB server's network access to cloud metadata services and internal HTTP endpoints where possible.