Description
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
Published: 2026-10-14
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an unauthenticated server‑side request forgery in Kan v0.5.5 through v0.6.0. When the S3_ENDPOINT configuration is missing, attackers can send arbitrary URLs to the /api/download/attatchment endpoint, which the application blindly forwards using fetch(). This allows the attacker to read internal services, localhost ports, and cloud instance metadata. The flaw can be used for information disclosure or lateral movement inside the infrastructure. The weakness is classified as CWE‑918.

Affected Systems

Affected installations are deployments of Kan released between v0.5.5 and v0.6.0 by kanbn. The product is a Node.js/TypeScript web API framework. No other Kan versions are currently documented as vulnerable, and only these release ranges contain the confirmed bug.

Risk and Exploitability

The CVSS score of 9.2 signals a critical severity. The EPSS score is below 1 %, indicating that exploitation is presently rare, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the endpoint with crafted query parameters; the server‑side fetch then accesses internal resources, potentially revealing sensitive information.

Generated by OpenCVE AI on October 15, 2026 at 21:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Kan to a patched release that eliminates the SSRF bug.
  • If an upgrade is not immediately possible, set the S3_ENDPOINT environment variable to a trusted host or leave it unset and block outbound connections from the application to internal IP ranges with firewall rules or an outbound proxy.
  • Configure the network perimeter or reverse proxy so that the application is unable to make outbound HTTP requests to internal resources, effectively disabling the SSRF vector.

Generated by OpenCVE AI on October 15, 2026 at 21:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
Title Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
First Time appeared Kan
Kan kan
Weaknesses CWE-918
CPEs cpe:2.3:a:kan:kan:*:*:*:*:*:*:*:*
Vendors & Products Kan
Kan kan
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Kan Kan
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T17:16:01.554Z

Reserved: 2026-10-14T13:07:29.410Z

Link: CVE-2026-110628

cve-icon Vulnrichment

Updated: 2026-10-16T16:46:51.154Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:15.540

Modified: 2026-10-16T18:17:32.790

Link: CVE-2026-110628

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T14:45:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)