CVE-2026-110628GHSA-qrx8-9hc6-jvqg
Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
kanbn kan
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
Text from CVE List
Affected versions 1
- kanaffected: 0.5.5 through 0.6.0CVE List
References 8
- github.com/kanbn/kan/pull/590Fixvia CVE List
- github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7Fixvia CVE List
- hackmd.io/@leediay/HyIxU63ofgAdvisoryvia CVE List
- github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqgAdvisoryvia CVE List
- vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchmentAdvisoryvia CVE List
- github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52Referencevia CVE List
- github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27Referencevia CVE List
- github.com/kanbn/kanReferencevia CVE List