CVE-2026-77522

Executive Summary

CVE-2026-77522 is a Server-Side Request Forgery (SSRF) vulnerability in MaxKB, an open-source AI assistant platform for enterprise use, affecting version 2.10.3-lts and earlier. A low-privileged, authenticated workspace user can supply a URL to the knowledge web-document import and synchronization crawler, which the application passes to Fork.fork, ultimately invoking requests.get with verify=False and without restrictions on URL scheme or destination address (loopback, link-local, private, or reserved ranges). Because the response body is converted into imported document content, the attacker can read cloud metadata endpoints or internal HTTP services through the MaxKB server, resulting in unauthorized information disclosure from the internal network.

Technical Analysis

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). The root cause sits in the knowledge base web-document import and synchronization crawler. When an authenticated workspace user provides a URL for import, the application passes that URL to Fork.fork, which in turn calls requests.get with verify=False and no validation of the target destination.

Three design weaknesses combine to produce the exposure:

1. Missing scheme restriction. The URL handling does not constrain the accepted scheme, so the request layer is not limited to expected HTTP(S) crawl targets at the scheme level.
2. Missing network-range restriction. There is no deny-list or allow-list preventing requests to loopback, link-local, private, or reserved address ranges. This means the server can be coerced into reaching its own internal interfaces and adjacent internal services.
3. TLS verification disabled. verify=False disables certificate validation, which removes a defensive signal and allows the request to proceed against endpoints presenting untrusted or self-signed certificates — typical of internal services.

The impact amplification is that the response body is not merely fetched and discarded: it is converted into imported document content. The attacker therefore receives the internal response as readable knowledge-base material through the normal MaxKB interface. This converts a blind-style SSRF into a full-read SSRF, where the content of the internal HTTP response is returned to the low-privileged user.

The NVD description states no fixed version is available as of this review, and the patch confidence for this report is 0/4 — no patch evidence exists from any tracked source.

Affected component: the knowledge web-document import and synchronization crawler in MaxKB <= 2.10.3-lts. Attack prerequisites are network reachability to the MaxKB instance and valid low-privileged authenticated access to a workspace.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the SSRF vulnerability class and the details in the NVD description. Only artifacts named in the description — Fork.fork, requests.get, the import/synchronization crawler — are referenced.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable MaxKB deployment running 2.10.3-lts or earlier. This is a legitimate enterprise application, so it is often exposed to internal users and sometimes to the internet for knowledge-base access. The attacker needs only a low-privileged account in a workspace.

2. Triggering the flaw. Using the authenticated workspace account, the attacker navigates to the knowledge web-document import / synchronization feature and supplies a crafted target URL. The application passes this URL into Fork.fork, which executes requests.get against it with verify=False. Because schemes and destination ranges are unrestricted, the attacker can direct the request at loopback addresses, link-local addresses (e.g., the cloud instance metadata service on the link-local range), private RFC1918 ranges, and reserved ranges.

3. Execution method at the vulnerability-class level. The attacker points the crawler at an internal-only HTTP endpoint that returns sensitive content — most notably cloud provider instance metadata services, or internal administrative/HTTP services reachable from the MaxKB host. The HTTP response returned to requests.get is converted by MaxKB into imported document content. The attacker then reads that imported document through the MaxKB interface, receiving the verbatim internal response.

4. Post-exploitation impact. The low-privileged user gains read access to internal network resources and, in cloud environments, potentially to instance metadata that may include credentials or role information. This enables escalation from a workspace-level account to visibility into the underlying infrastructure, supporting further lateral movement and credential abuse. Note the CVSS vector rates confidentiality as None (C:N) and integrity as Low (I:L); this report does not contradict that score but notes that the underlying SSRF-to-read primitive described in the NVD text logically exposes the response body of internal endpoints to the requester. Analysts should reconcile the CVSS confidentiality rating with the feature's documented behavior when triaging.

Impact Assessment

• CVSS v3.1: 4.3 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
  • AV:N — exploitable over the network.
  • AC:L — no special conditions beyond a crafted URL.
  • PR:L — requires low-privileged authenticated workspace access.
  • UI:N — no user interaction.
  • S:U — scope is unchanged.
  • I:L — low integrity impact, consistent with imported content being populated with attacker-chosen retrieval results.
• Affected systems: MaxKB deployments at <= 2.10.3-lts, particularly those reachable from lower-trust network segments and those hosted in cloud environments where a link-local metadata service is present.
• Blast radius: Bounded by what the MaxKB host can reach on the internal network. Because the server performs the request, the blast radius includes internal services that trust the MaxKB server's network position. In cloud-hosted deployments, exposure can extend to instance metadata and any credentials exposed there.
• Exploitation status: No public PoC, no Nuclei template, no exploit code, and not listed in CISA KEV. EPSS has not been scored by FIRST.org. Exploitation is currently assessed as requiring a motivated insider or any holder of a low-privileged account.

Detection Guidance

Sigma Rule

title: MaxKB SSRF via Web Document Import Crawler
id: 9a7c2f10-4b8e-4d3a-9f22-0c1d5e6a7b88
status: experimental
description: Detects suspicious URLs submitted to MaxKB web-document import/synchronization that target loopback, link-local, private, or reserved address ranges (CWE-918).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77522
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'import'
      - 'sync'
      - 'web'
  selection_ssrf_target:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '0.0.0.0'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '[::1]'
      - 'metadata.google.internal'
      - 'file://'
      - 'gopher://'
      - 'dict://'
  condition: selection_endpoint and selection_ssrf_target
falsepositives:
  - Legitimate internal knowledge imports by administrators
level: high

YARA Rule

rule CVE_2026_77522_MaxKB_SSRF
{
    meta:
        description = "Detects MaxKB artifacts referencing SSRF-prone crawler behavior with disabled TLS verification"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77522"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $f1 = "Fork.fork" ascii wide
        $f2 = "requests.get" ascii wide
        $f3 = "verify=False" ascii wide
        $f4 = "169.254.169.254" ascii wide
        $f5 = "metadata.google.internal" ascii wide

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true and
        (($f2 and $f3) or ($f1 and $f3) or ($f4) or ($f5))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77522 MaxKB SSRF Attempt via Web Document Import"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"import"; nocase; http.request_body; content:"169.254.169.254"; nocase; reference:cve,2026-77522; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77522; classtype:attempted-recon; sid:2026775221; rev:1;)

alert http any any -> any any (msg:"CVE-2026-77522 MaxKB SSRF Loopback/Internal Target"; flow:to_server,established; http.request_body; pcre:"/(127\.0\.0\.1|localhost|169\.254\.169\.254|0\.0\.0\.0|metadata\.google\.internal|file:\/\/|gopher:\/\/)/i"; reference:cve,2026-77522; classtype:attempted-recon; sid:2026775222; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where event.category == "web" and url.path != null and
      (url.path contains "import" or url.path contains "sync" or url.path contains "web") and
      url.query contains "http" ]
  [ network where event.category == "web" and
      (url.query contains "169.254.169.254" or
       url.query contains "127.0.0.1" or
       url.query contains "localhost" or
       url.query contains "0.0.0.0" or
       url.query contains "metadata.google.internal" or
       url.query contains "file://" or
       url.query contains "gopher://") ]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*import*" OR uri_path="*sync*" OR uri_path="*web*")
| eval target=coalesce(uri_query, request_body, url)
| where match(target, "(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|0\.0\.0\.0|metadata\.google\.internal|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|file://|gopher://|dict://)")
| stats count values(target) as targets by src_ip, user, dest_host
| sort - count

Wazuh OSSEC Rule

<group name="web,maxkb,ssrf,">
  <rule id="2027752" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>import|sync</match>
    <regex>(127\.0\.0\.1|localhost|169\.254\.169\.254|0\.0\.0\.0|metadata\.google\.internal|file://|gopher://|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|10\.)</regex>
    <description>CVE-2026-77522: MaxKB possible SSRF attempt via web-document import/synchronization crawler targeting internal or restricted address range.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_77522,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No fixed version is available as of this review, and no vendor workaround is documented.

1) Immediate mitigations

• Restrict who can create or edit knowledge bases and trigger web-document imports/synchronization; limit to trusted administrators only.
• Enforce network-level egress controls from the MaxKB host so it cannot reach loopback, link-local (including cloud metadata endpoints such as 169.254.169.254), private (RFC1918), or reserved ranges, except where explicitly required.
• Block the cloud instance metadata service from the MaxKB workload using host firewall rules and, where available, IMDSv2 enforcement with request-hop-limit and token requirements.
• Place MaxKB behind an authenticated reverse proxy and log all import/synchronization requests, including full URL parameters, for detection.
• Monitor and review imported document content for internal service responses that may have been exfiltrated through the knowledge base.

2) Patch / upgrade steps

• No patch is available. Monitor the MaxKB project for a security release that adds URL scheme validation and destination-range filtering, and removes verify=False from the crawler request path. Upgrade immediately once a fixed version is published.

3) Long-term hardening

• Enforce an allow-list of permitted URL schemes and destinations for all server-side fetch functionality; default-deny is preferred over deny-listing.
• Re-enable TLS certificate validation (verify should not be set to False) for all outbound requests.
• Deploy SSRF defenses at the application layer, including DNS resolution checks that reject requests resolving to loopback, link-local, private, and reserved addresses, plus re-validation after redirects.
• Segment the MaxKB application so it runs with minimal network reachability, applying least privilege to what internal services it can contact.
• Continuously scan for and inventory SSRF-prone fetch routines in the codebase (CWE-918), prioritizing features that render fetched content back to users.

References

• NVD — CVE-2026-77522: https://nvd.nist.gov/vuln/detail/CVE-2026-77522
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MaxKB project repository and release notes (monitor for fixed version): https://github.com/1Panel-dev/MaxKB
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-77522 not listed as of this review): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-77522 at the time of this report. No public PoC, Nuclei template, or exploit code is available; the vulnerability is not listed in CISA KEV.