CVE-2026-32255 Details
Description
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).
A server-side request forgery (SSRF) vulnerability has been identified in the Kan project management tool, affecting versions prior to 0.5.5. The issue arises in the '/api/download/attatchment' endpoint, which lacks authentication and proper URL validation. This endpoint allows unauthenticated attackers to send HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources, potentially exposing sensitive information or causing unintended actions. The vulnerability has been patched in version 0.5.5.
Users are advised to update to Kan version 0.5.5 or later. For those unable to update, access to the '/api/download/attatchment' endpoint should be blocked or restricted at the reverse proxy level, using tools such as nginx or Cloudflare.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7 | [email protected] | Patch |
| https://github.com/kanbn/kan/releases/tag/v0.5.5 | [email protected] | ProductRelease Notes |
| https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kan kan | < 0.5.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |