CVE-2026-42335 MEDIUM

CVE-2026-42335: MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy

Vendor 1Panel-Dev
Product MaxKB
Weakness CWE-918 · SSRF
Published May 26, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

What the vulnerability does

01Description

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch (chat/api/oss/get_url) endpoint. The vulnerability exists due to inconsistent URL parsing between the urlparse validation function and the requests HTTP client, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.

Key dates

02Disclosure timeline

May 26, 2026 CVE published
May 27, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-58615 WordPress WP Bannerize Pro Plugin <= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerability CVE-2026-41481 LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass CVE-2026-10280 horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery CVE-2025-58045 Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter CVE-2026-8725 CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side request forgery