PT-2026-52548 · 1Panel Dev · Maxkb

George Chen · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-56779

NVD

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-56779

Produtos afetados

Maxkb

Referências · 4

• 🔥 https://github.com/1Panel-dev/MaxKB/issues/6272 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56779 · Nota de Segurança
• https://github.com/1Panel-dev/MaxKB/commit/6c156afc656afa62ea4280e504a06ac1c9696b36 · Correção
• https://vulncheck.com/advisories/maxkb-server-side-request-forgery-via-downloadcallbackurl-and-download-url-parameters · Nota