Kan: Server-side request forgery in attachment download endpoint
Summary
Kan, an open-source project management application, contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route. It is an incomplete fix for CVE-2026-32255. If S3_ENDPOINT is unset, an unauthenticated attacker can make the server fetch arbitrary URLs, which allows reading internal services, localhost ports and cloud instance metadata.
Affected
- Kan 0.5.5 through 0.6.0 (kanbn/kan)
- Relevant when S3_ENDPOINT is unset
Fixed in
Unknown. No fixed release for this CVE has been confirmed; check the vendor advisory GHSA-qrx8-9hc6-jvqg and the Kan releases for a version later than 0.6.0.
Workaround
- Block or restrict access to /api/download/attatchment at the reverse proxy until a fixed version is confirmed
- Ensure outbound connections from the Kan server to localhost, private networks and metadata addresses are blocked
- A generic WAF rule is not a fix
Exploitation
- No exploitation in the wild confirmed for this CVE
- VulDB lists no available exploit
- A public proof-of-concept exists for the predecessor CVE-2026-32255, none found for this CVE
- CISA SSVC for the predecessor: exploitation none, automatable yes
Our recommendation
- Inventory all Kan instances and confirm the installed version
- Restrict the vulnerable endpoint at the reverse proxy and keep Kan off the public internet where possible
- Review whether the server can reach cloud metadata endpoints and restrict this
- Rotate credentials that the Kan server could access if exposure is suspected
- Monitor for server egress to localhost, private ranges and metadata addresses
- Apply the vendor fix as soon as a version later than 0.6.0 is confirmed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-110628 VulnCheck advisory www.vulncheck.com
- GitHub Security Advisory GHSA-qrx8-9hc6-jvqg github.com
- Kan repository github.com
- Kan pull request 590 github.com
- Kan fix commit 53397d8e github.com
- Kan v0.6.0 attachment download source github.com
- Kan v0.6.0 example environment file github.com
- Atomicorp WAF rule 398022 research.atomicorp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:36.
Original description (NVD)
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
NVD references (8)
- https://github.com/kanbn/kan
- https://github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27
- https://github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52
- https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7
- https://github.com/kanbn/kan/pull/590
- https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg
- https://hackmd.io/@leediay/HyIxU63ofg
- https://www.vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchment
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.