Why it matters
Enables an authenticated but otherwise low-privilege workspace user to pivot into internal network resources via the MaxKB server, potentially reaching cloud metadata endpoints or internal admin interfaces not normally exposed.
Attack vector
UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url values to requests.get without trusted-host or redirect validation, allowing an authenticated workspace user to trigger SSRF against internal services.
Affected systems
MaxKB 2.0.0 through 2.10.4-lts
Mitigation
Upgrade per the GitHub commit fix; add trusted-host allowlisting and redirect validation to outbound requests in tool-management code.