Description

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T21:17:11.120Z",
  "pubdate": "2026-09-21T21:17:11.120Z",
  "executiveSummary": "MaxKB version 2.10.3-lts and earlier are susceptible to a critical Server-Side Request Forgery (SSRF) vulnerability. The flaw resides within the knowledge web-document import and synchronization crawler, which fails to adequately validate user-supplied URLs.\nThis vulnerability allows authenticated workspace users to force the MaxKB server to perform unauthorized HTTP requests to arbitrary destinations, including local loopback interfaces, private network services, and cloud provider metadata endpoints (e.g., AWS/GCP/Azure instance metadata services).\nBy leveraging the application's ability to fetch and import external web content, an attacker can bypass network-level security controls, probe internal network infrastructure, and exfiltrate sensitive data or configuration information. The vulnerability does not require administrative privileges, as standard authenticated workspace users can initiate the malicious requests. Given the lack of input sanitization and the absence of transport layer security enforcement (via verify=False), the impact includes unauthorized data exposure, reconnaissance of internal services, and potential compromise of environment-specific credentials.",
  "technicalDetails": "The vulnerability originates in the knowledge web-document import and synchronization crawler component of MaxKB. When a user provides a URL for document import, the application processes this input via the Fork.fork function. This function proceeds to invoke the requests.get method with the 'verify' parameter explicitly set to False, effectively disabling SSL/TLS certificate verification.\nCrucially, the application fails to implement an allow-list or filter for destination addresses. It does not restrict the URL scheme, nor does it block connections to loopback (127.0.0.1/8), link-local (169.254.0.0/16), or private (RFC 1918) IP address spaces. Consequently, the server-side crawler becomes an unrestricted proxy for the attacker.\nThe exploitation flow follows these steps: 1) An authenticated user initiates a knowledge web-document import request within their workspace. 2) The user provides a crafted URL targeting an internal resource, such as 'http://169.254.169.254/latest/meta-data/' or an internal administrative dashboard at 'http://localhost:8080'. 3) The MaxKB server processes this input through the vulnerable Fork.fork function, dispatching an HTTP GET request to the target destination without transport verification. 4) The server receives the response from the internal or restricted target and converts the body of the response into document content stored within the MaxKB system.\nThe attacker is then able to retrieve the imported document content through the standard application interface, effectively exfiltrating the contents of the internal HTTP response. This mechanism facilitates the extraction of cloud environment credentials (metadata service tokens), service configuration files, or internal service responses that would otherwise be inaccessible from the public internet. The combination of disabled SSL verification and the absence of address restriction allows for successful interaction with both HTTPS-enabled internal services and cleartext HTTP endpoints. Because the requests are originated from the server itself, the attacker bypasses any firewall or Access Control Lists (ACLs) that would otherwise isolate the MaxKB instance from the target services."
}