Skip to content
Fencer Vulns
high 8.6

CVE-2026-32255 in the critical feed json

Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint

published 2026-03-18 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-12997

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
26.9%
EPSS 26.9% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

Patch / fix

  • kan kan 0.5.5

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

26.90% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Kan <= 0.5.4 - Server-Side Request Forgery nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

  • kanbn kan

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.