CVE-2026-110628

High

Description

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

SeverityHigh

CVSS8.6

Exploit probability—

ProductKan

PublishedOct 14, 2026

First seenOct 14, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Patches

github.com/kanbn/kan/pull/590
github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7

Vendor advisories

github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg

Affected products

Product	Affected versions	Fixed in
kanbn kan	0.5.5 ≤ v ≤ 0.6.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.