CVE-2026-42335 — MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy

CVE-2026-42335

MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy PUBLISHED

Description (CNA)

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch (chat/api/oss/get_url) endpoint. The vulnerability exists due to inconsistent URL parsing between the urlparse validation function and the requests HTTP client, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.

Affected (CNA)

Vendor / product	Versions
1Panel-dev / MaxKB	affected < 2.8.1

CWE

CWE-918

References

https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-r8hf-mwwr-hxgc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.