CVE-2026-32255: Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-19 · updated 2026-06-17
Weakness: CWE-918

Description

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

Affected products

kanbn kan: before 0.5.5 — fixed in 0.5.5

How to fix

Upgrade to a fixed version: kanbn kan 0.5.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-32255 or the next vulnerability affects your stack