CVE-2026-56779

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.0

Description Authenticated users with the default workspace USER role can perform a server-side request forgery (SSRF) by providing unvalidated input to the ToolSerializer endpoints. This allows an attacker to make arbitrary server requests and access internal network services through the downloadCallbackUrl and download url parameters.

Recommendations Update to version 2.10.0 or later. Avoid using the downloadCallbackUrl and download url parameters in tool creation and update endpoints until the update is applied.