CVE-2026-77522

Summary

The flaw allows a low-privileged user to read cloud metadata or internal HTTP services by importing documents through MaxKB's document import feature due to insecure requests.get calls with verify=False. This matters because it can lead to unauthorized data exposure.

Exploitability

Exploitation requires access to the authenticated workspace and knowledge of the URL format, making it moderately difficult but feasible for attackers in controlled environments.

Blast radius

If exploited, this could result in significant data breaches affecting internal services and cloud metadata visibility within the organization.

Prioritized remediation

Update MaxKB to a version that restricts schemes, disables loopback, link-local, private, or reserved address access, and ensures secure HTTPS requests.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.