medium6.4
CVE-2026-56779
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrar…
Impact
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.
Affected products
| Product | Affected versions |
|---|---|
| MaxKB | before 2.10.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.