CVE-2026-42336 — MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch

CVE-2026-42336

MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch PUBLISHED

Description (CNA)

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.

Affected (CNA)

Vendor / product	Versions
1Panel-dev / MaxKB	affected < 2.8.1

CWE

CWE-367, CWE-918

References

https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-6m4p-9wwc-4q5q

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.