1Panel-dev MaxKB up to 2.9.x ToolSerializer Endpoint download_url server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, was found in 1Panel-dev MaxKB up to 2.9.x. This issue affects some unknown processing of the component ToolSerializer Endpoint. Executing a manipulation of the argument download_url can lead to server-side request forgery. This vulnerability is handled as CVE-2026-56779. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in 1Panel-dev MaxKB up to 2.9.x and classified as critical. This vulnerability affects some unknown functionality of the component ToolSerializer Endpoint. The manipulation of the argument download_url with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.

The weakness was released by George Chen as 6272. The advisory is available at github.com. This vulnerability was named CVE-2026-56779 since 06/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 2.10.0 eliminates this vulnerability. Applying the patch 6c156afc656afa62ea4280e504a06ac1c9696b36 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• 1Panel-dev

Name

• MaxKB

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9

License

• open-source

Website

• Product: https://github.com/1Panel-dev/MaxKB/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion