CVE-2026-77522: MaxKB Information Disclosure Vulnerability

CVE-2026-77522 Overview

CVE-2026-77522 is a Server-Side Request Forgery (SSRF) vulnerability in MaxKB, an open-source AI assistant for enterprise deployments. The flaw affects version 2.10.3-lts and earlier. The knowledge web-document import and synchronization crawler forwards an authenticated workspace user's URL directly to Fork.fork, which invokes requests.get with verify=False and no scheme or address restrictions. A low-privileged authenticated user can pivot the MaxKB server into internal networks, cloud metadata endpoints, and loopback services. No fixed version was available at the time of publication.

Critical Impact
Authenticated low-privileged users can read cloud instance metadata and internal HTTP services through the MaxKB server, exposing credentials and internal application data.

Affected Products

MaxKB version 2.10.3-lts
MaxKB versions prior to 2.10.3-lts
1Panel-dev MaxKB open-source AI assistant deployments

Discovery Timeline

2026-09-21 - CVE-2026-77522 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-77522

Vulnerability Analysis

The vulnerability is categorized as Server-Side Request Forgery [CWE-918]. MaxKB exposes a knowledge web-document import feature that accepts a URL from any authenticated workspace user. The application passes that URL to the Fork.fork crawler routine without validating the destination. The crawler calls requests.get with TLS verification disabled (verify=False) and returns the HTTP response body as imported document content.

Because the server does not restrict URL schemes, loopback interfaces, link-local ranges, private RFC 1918 addresses, or reserved address space, attackers can direct the crawler to arbitrary internal targets. Any response the server can reach is written back into the document store and becomes readable to the requesting user.

Root Cause

The root cause is missing input validation on the crawler destination. Fork.fork neither enforces an allowlist of schemes such as http and https nor blocks requests to sensitive network ranges. Disabling TLS verification compounds the issue by allowing interaction with internal services that present self-signed certificates.

Attack Vector

An authenticated attacker submits a crafted URL through the web-document import or synchronization workflow. Typical targets include cloud provider metadata endpoints such as http://169.254.169.254/, loopback administrative interfaces on http://127.0.0.1/, and internal service URLs within the deployment's private network. The crawler retrieves the resource and stores the response as importable document content, which the attacker then reads through the standard MaxKB knowledge interface. See the GitHub Security Advisory GHSA-ffxw-frpx-8rww for technical details.

Detection Methods for CVE-2026-77522

Indicators of Compromise

Outbound HTTP requests from the MaxKB server process to 169.254.169.254, 127.0.0.1, or RFC 1918 address ranges without a business justification.
Web-document import records whose source URL points at internal, loopback, link-local, or non-standard scheme destinations.
Unusual document entries containing cloud metadata fields such as iam/security-credentials or JSON blobs referencing internal service endpoints.

Detection Strategies

Review MaxKB application logs for the web-document import endpoint and correlate submitted URLs against a deny list of internal address ranges.
Inspect the knowledge base for imported documents whose content matches cloud metadata response schemas from AWS, Azure, or GCP.
Monitor egress network flows from the MaxKB host and alert on connections that terminate on internal RFC 1918 destinations or the link-local range.

Monitoring Recommendations

Enable verbose HTTP client logging on the MaxKB server to capture destination hosts requested by the crawler.
Forward MaxKB application and proxy logs to a centralized analytics platform for URL pattern analysis.
Alert on any authenticated user who submits multiple import URLs targeting non-public IP space within a short time window.

How to Mitigate CVE-2026-77522

Immediate Actions Required

Restrict access to the web-document import and synchronization features to trusted administrators until a patch is available.
Deploy an egress filtering proxy in front of the MaxKB server that blocks outbound requests to loopback, link-local, private, and reserved address ranges.
Rotate any cloud instance credentials that could have been exposed through metadata service access from the MaxKB host.

Patch Information

No fixed version is available as of the advisory review. Track the GitHub Security Advisory GHSA-ffxw-frpx-8rww for vendor updates and apply the patched release as soon as it is published.

Workarounds

Run MaxKB in a network segment that has no route to cloud metadata endpoints or internal management services.
Use IMDSv2 with a hop limit of 1 on AWS EC2 hosts to block metadata retrieval by the containerized MaxKB workload.
Configure an outbound HTTP proxy that enforces scheme allowlisting (http, https only) and blocks internal destinations for all MaxKB crawler traffic.

bash

# Example egress restriction using iptables on the MaxKB host
iptables -A OUTPUT -m owner --uid-owner maxkb -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner maxkb -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner maxkb -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner maxkb -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner maxkb -d 192.168.0.0/16 -j REJECT