PT-2026-52548 · 1Panel Dev · Maxkb

George Chen · Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-56779

Mitre

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-56779

Affected Products

Maxkb

References · 4

• 🔥 https://github.com/1Panel-dev/MaxKB/issues/6272 · Exploit
• https://github.com/1Panel-dev/MaxKB/commit/6c156afc656afa62ea4280e504a06ac1c9696b36 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56779 · Security Note
• https://vulncheck.com/advisories/maxkb-server-side-request-forgery-via-downloadcallbackurl-and-download-url-parameters · Note