CVE-2026-77522Medium· 4.3▾ TwilightPoC availableMaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get wit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.3%
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-64511High· 7.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-77519Medium· 5.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-77518Medium· 5.0MaxKB is an open-source AI assistant for enterprise
CVE-2026-77525Medium· 4.2MaxKB is an open-source AI assistant for enterprise
CVE-2026-77516Medium· 5.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-77521Critical· 10.0MaxKB is an open-source AI assistant for enterprise