CVE-2026-42336 is a TOCTOU race condition vulnerability in 1Panel-dev's MaxKB (version 2.8.0 and prior) affecting the OSS file service URL fetch functionality. The vulnerability arises because DNS resolution during the validation phase differs from that during the actual request execution, enabling an attacker to bypass SSRF protections and access internal network services. This vulnerability is fixed in MaxKB version 2.8.1. The CVSS 4.0 base score is 5.1, indicating medium severity. There are no known exploits in the wild, and the product is not a cloud service.

Successful exploitation allows an attacker with low privileges to bypass SSRF protections and access internal network services that are otherwise inaccessible externally. This could lead to unauthorized internal network reconnaissance or interaction with internal services. There are no reports of active exploitation in the wild at this time.

Upgrade MaxKB to version 2.8.1 or later, where this TOCTOU SSRF bypass vulnerability is fixed. Since this is an official fix, applying the update fully mitigates the issue. No additional vendor advisories indicate alternative mitigations or that no action is required.