The vulnerability is an unauthenticated server‑side request forgery in Kan 0.5.5 through 0.6.0. An attacker can supply arbitrary URLs to the /api/download/attatchment endpoint and the application will fetch them using fetch(), allowing access to internal services, localhost ports, and cloud instance metadata. This flaw enables information disclosure and potential lateral movement, as the attacker can read data that should be restricted to internal components. The weakness is formalized as CWE‑918.

Kan v0.5.5 through v0.6.0 deployed by kanbn is affected. The environment is typically a Node.js/TypeScript application hosting a web API. Version information is identified in the source code references to commit 53397d8e and release tags v0.5.5 and v0.6.0. No other Kan versions are documented as vulnerable.

The CVSS score is 9.2, indicating critical severity. No EPSS score is published, but the absence of an exploitation probability does not negate the high impact. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers could exploit this flaw by sending unauthenticated HTTP requests to the vulnerable endpoint with crafted query parameters, bypassing authentication checks. Since the fetch request is executed server‑side, internal resources like http://localhost, http://169.254.169.254 or other cloud metadata services become reachable, potentially exposing configuration, tokens, or secrets.