PT-2026-26167 · Kan · Kan

Koadt · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-32255

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kan versions 0.5.4 and below

Description Kan is an open-source project management tool. Versions 0.5.4 and below lack authentication and URL validation in the /api/download/attatchment endpoint. This endpoint accepts a user-supplied URL query parameter, passes it directly to the fetch() function server-side, and returns the full response body. An unauthenticated attacker can leverage this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This is a Server-Side Request Forgery (SSRF) issue.

Recommendations Versions prior to 0.5.5 should be updated to version 0.5.5 or later. Block or restrict access to the /api/download/attatchment endpoint at the reverse proxy level (nginx, Cloudflare, etc.).

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-32255

GHSA-QRX8-9HC6-JVQG

Affected Products

Kan

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32255.json · Exploit
• https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7 · Patch
• https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32255 · Security Note
• https://github.com/kanbn/kan/releases/tag/v0.5.5 · Note
• https://twitter.com/CVEnew/status/2034520404165837163 · Twitter Post
• https://twitter.com/NewsNerdie/status/2034691844932546696 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034427354886582293 · Twitter Post
• https://twitter.com/CVEarity/status/2035325403326517583 · Twitter Post
• https://twitter.com/CveFindCom/status/2034430320007680304 · Twitter Post
• https://twitter.com/integ_sec/status/2035359544453251524 · Twitter Post