CVE-2026-57862 Details
Description
Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php incorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.
A server-side request forgery (SSRF) vulnerability has been identified in Kanboard versions through 1.2.52. This vulnerability allows authenticated users to bypass existing SSRF protections by using hexadecimal IP address notation in user-controlled URLs. The issue arises because the 'isPrivateURL()' filter in 'app/Core/Http/Client.php' incorrectly classifies these hexadecimal-encoded internal IP addresses as safe. As a result, cURL can resolve and connect to internal network resources, such as cloud instance metadata services, localhost services, and RFC1918 addresses.
Users are advised to update Kanboard to version 1.2.53 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sermikr0/67c8acfc395e465127e729dc309da3ae | CISA-ADP | ExploitTechnical Analysis |
| https://gist.github.com/sermikr0/67c8acfc395e465127e729dc309da3ae | [email protected] | ExploitTechnical Analysis |
| https://github.com/kanboard/kanboard | [email protected] | ProductSource CodeVendor |
| https://www.vulncheck.com/advisories/kanboard-and-prior-ssrf-filter-bypass-via-hexadecimal-ip-notation | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kanboard | <= 1.2.52 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | CVE Modified | [email protected] |
| Jul 30, 2026 | New CVE Received | [email protected] |