PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56779 1Panel-dev CVE debrief

CVE-2026-56779 is a server-side request forgery (SSRF) vulnerability in MaxKB, a tool that provides knowledge base management. The vulnerability exists in the tool creation and update endpoints and allows authenticated users with the default workspace USER role to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. This can be exploited to access internal network services. The vulnerability was publicly disclosed on June 25, 2026, and the CVSS score is 5.3, indicating a medium severity level. The vendor, Unknown Vendor, has not provided a canonical source, but Vulncheck has reported on this vulnerability.

Vendor
1Panel-dev
Product
MaxKB
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-06-30
Advisory published
2026-06-25
Advisory updated
2026-06-30

Who should care

Security teams and administrators responsible for MaxKB installations should be aware of this vulnerability. Authenticated users with the default workspace USER role may be able to exploit this vulnerability to access internal network services. Organizations using MaxKB versions prior to 2.10.0 should prioritize patching or mitigating this vulnerability.

Technical summary

The vulnerability exists in the tool creation and update endpoints of MaxKB, allowing authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The weakness is classified as CWE-918, Server-Side Request Forgery.

Defensive priority

Patching or mitigating this vulnerability is a high priority due to its medium severity level and potential impact on internal network services. Organizations should review their MaxKB installations and apply the necessary patches or compensating controls.

Recommended defensive actions

  • Review and apply patches for MaxKB versions prior to 2.10.0
  • Implement compensating controls to restrict access to internal network services
  • Monitor for suspicious activity related to MaxKB tool creation and update endpoints
  • Restrict access to MaxKB tool creation and update endpoints for users with the default workspace USER role
  • Perform regular security audits and vulnerability assessments

Evidence notes

The vulnerability was reported by Vulncheck and publicly disclosed on June 25, 2026. The CVE record and NVD detail pages provide additional information on this vulnerability. The vendor, Unknown Vendor, has not provided a canonical source, but Vulncheck has reported on this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56779 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56779

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56779 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56779

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.