Open-Source AI Assistant Vulnerability in MaxKB

CVE-2026-77522

What is CVE-2026-77522?

MaxKB, an open-source AI assistant for enterprises, has a vulnerability in versions 2.10.3-lts and earlier where the knowledge web-document import and synchronization crawler inadequately handles user-provided URLs. This flaw allows an authenticated low-privileged user to exploit the system's functionality by accessing cloud metadata and internal HTTP services through the MaxKB server. Due to the lack of scheme restrictions and verification processes, sensitive information may be leaked, posing significant security risks to organizations using this application.

References