CVE-2026-56779 is a server-side request forgery vulnerability affecting MaxKB before version 2.10.0. The flaw exists in the ToolSerializer endpoints used during tool creation and update, where the downloadCallbackUrl and download_url parameters are not properly validated. Authenticated users with the default USER role can exploit this to make arbitrary requests from the server, potentially accessing internal network resources. The vulnerability has not been confirmed to be exploited in the wild, and no official remediation or patch has been documented as of the published date.

An attacker with authenticated access and the default USER role can leverage this vulnerability to cause the server to make arbitrary HTTP requests. This can lead to unauthorized access to internal network services that are otherwise inaccessible externally. The impact is limited by the requirement for authentication and the USER role, but it still poses a risk of internal network reconnaissance or accessing sensitive internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions where possible and monitor for unusual internal request patterns. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow vendor updates closely for any forthcoming patches or official mitigations.