Medium severityNVD Advisory· Published May 26, 2026· Updated May 27, 2026

CVE-2026-45412

Description

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary URLs in work_flow_template.downloadUrl which are fetched server-side without any URL validation or internal IP filtering. This vulnerability is fixed in 2.9.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1panel Dev/Maxkbinferred
Range: <2.9.1

Patches

Vulnerability mechanics

References

github.com/1Panel-dev/MaxKB/security/advisories/GHSA-x9g5-j56j-4mfjnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000