CVE-2026-64870 1Panel-dev CVE debrief

Who should care

Defenders of systems using MaxKB versions 2.0.0 through 2.10.4-lts should assess exposure and prioritize applying the fix. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the vulnerability's impact on their systems and apply the fix.

Why it matters

CVE-2026-64870 is a vulnerability in MaxKB that allows authenticated users to make server requests to internal, loopback, link-local, or cloud metadata URLs. Defenders of systems using MaxKB versions 2.0.0 through 2.10.4-lts should assess exposure and prioritize applying the fix.

• Authenticated users may be able to make server requests to internal, loopback, link-local, or cloud metadata URLs
• Defenders need to verify the vulnerability's impact on their systems and apply the fix

Technical summary

The vulnerability is caused by the UpdateStoreTool.update_tool function passing caller-supplied download_url and download_callback_url values to requests.get without equivalent trusted-host and redirect validation. This allows an authenticated workspace user to make the server request internal, loopback, link-local, or cloud metadata URLs. The vulnerability affects MaxKB versions 2.0.0 through 2.10.4-lts. Defenders should prioritize verifying the vulnerability's impact on their systems and applying the fix present on the v2 branch.

Defensive priority

Defenders should prioritize verifying the vulnerability's impact on their systems and applying the fix present on the v2 branch.

Recommended defensive actions

• Verify the vulnerability's impact on your systems
• Apply the fix present on the v2 branch
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. A fix is present on the v2 branch but has not yet been included in a published release. The vulnerability allows an authenticated workspace user to make the server request internal, loopback, link-local, or cloud metadata URLs. Evidence is limited to the CVE record and NVD detail page. Defenders should verify the vulnerability's impact on their systems and apply the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.