CVE-2026-77522

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.10.3-lts and earlier

Description An authenticated workspace user can perform a Server-Side Request Forgery (SSRF) via the knowledge web-document import and synchronization crawler. The application passes a user-supplied URL to the Fork.fork function, which executes requests.get with verify=False and fails to restrict schemes or block loopback, link-local, private, or reserved addresses. This allows a low-privileged user to read internal HTTP services or cloud metadata through the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.