CVE-2026-42336CWE-367CWE-918

MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch

Medium · published May 26, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS
0.00296 · 21.1th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-26T20:22Z
EPSS history
Timeline
  • 26 MAY 20:22Z
    MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
    cvelistv5