CVE-2026-110628

Published: Oct 14, 2026Modified: Oct 16, 2026Deferred

9.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (8)

https://github.com/kanbn/kan

Source: disclosure@vulncheck.com

https://github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27

Source: disclosure@vulncheck.com

https://github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52

Source: disclosure@vulncheck.com

https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7

Source: disclosure@vulncheck.com

https://github.com/kanbn/kan/pull/590

Source: disclosure@vulncheck.com

https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg

Source: disclosure@vulncheck.com

https://hackmd.io/@leediay/HyIxU63ofg

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchment

Source: disclosure@vulncheck.com

Timeline

No history available yet.