PT-2026-43397 · Maxkb · Maxkb

Forimoc + 1 · Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-42336

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.1

Description An issue exists in the OSS file service URL fetch functionality where inconsistent DNS resolution occurs between the validation phase and the actual request execution. This allows for a server-side request forgery (SSRF) bypass, enabling attackers to access internal network services. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 2.8.1.

Fix

SSRF

Time Of Check To Time Of Use

Weakness Enumeration

CWE-918

CWE-367

Related Identifiers

CVE-2026-42336

Affected Products

Maxkb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-42336 · Security Note
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-6m4p-9wwc-4q5q · Note
• https://t.me/cveNotify/164921 · Telegram Post