Medium severity · published May 26, 2026
CVE-2026-42335
MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch (chat/api/oss/get_url) endpoint. The vulnerability exists due to inconsistent URL parsing between the urlparse validation function and the requests HTTP client, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MaxKB · 1Panel-dev
< 2.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42335
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42335
github.com
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-r8hf-mwwr-hxgc
More from MaxKB
10.0
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution
10.0
CVE-2025-66419
MaxKB vulnerable to privilege escalation through sandbox bypass
9.8
CVE-2025-53928
MaxKB has RCE in MCP call
9.1
CVE-2026-79916
MaxKB AWS Bedrock model credential injection leads to remote code execution
8.8
CVE-2026-54149
MaxKB MCP tool import validation bypass allows post-authentication remote code execution