CVE-2026-56779 is a server-side request forgery vulnerability affecting MaxKB before version 2.10.0. The flaw exists in the ToolSerializer endpoints used for tool creation and update, where the downloadCallbackUrl and download_url parameters are not properly validated. Authenticated users with limited privileges (default USER role) can exploit this to make arbitrary requests from the server, potentially accessing internal network resources. No official patch or remediation level has been provided by the vendor as of the published date.

An attacker with authenticated access and default USER privileges can leverage this SSRF vulnerability to make arbitrary HTTP requests from the server hosting MaxKB. This can lead to unauthorized access to internal network services that are otherwise inaccessible externally. The vulnerability does not require elevated privileges or user interaction beyond authentication. The CVSS score of 5.3 reflects a medium impact, with network attack vector, low attack complexity, and limited integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions where possible and monitor for suspicious activity involving the affected endpoints. Avoid exposing sensitive internal services accessible via the server. Do not rely on this vulnerability being mitigated without vendor confirmation.