CVE-2026-42336 MEDIUM

CVE-2026-42336: MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch

Vendor 1Panel-Dev
Product MaxKB
Weakness CWE-367
Published May 26, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

What the vulnerability does

01Description

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.

Key dates

02Disclosure timeline

May 26, 2026 CVE published
May 27, 2026 Record updated