MaxKB versions 2.0.0 through 2.10.4-lts contain an SSRF vulnerability (CWE-918) in the UpdateStoreTool.update_tool function. This function uses caller-supplied download_url and download_callback_url parameters directly in requests.get calls without validating the host or redirects. This lack of validation permits an authenticated workspace user to induce the server to make HTTP requests to internal, loopback, link-local, or cloud metadata service URLs. Although a fix is present on the v2 development branch, it has not been included in any published release as of the advisory date.

An authenticated user can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or sensitive network resources, potentially exposing internal services or metadata endpoints. This could lead to information disclosure or further attacks leveraging internal network access. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, and limited privileges required.

As of the advisory date, no official patch or release includes the fix, though it exists on the development branch. Users should monitor the vendor's releases for an official update that includes the fix. Until then, restrict authenticated user permissions to trusted users only and consider network-level controls to limit server access to sensitive internal endpoints. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.