Description
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kanbn | kan | 0.5.5 – ≤ 0.6.0 | — |
References
- https://hackmd.io/@leediay/HyIxU63ofg third-party-advisory
- Open PR describing the S3_ENDPOINT-unset bypass issue-tracking patch
- allowlist conditional on S3_ENDPOINT, unconditional fetch(url) technical-description
- S3_ENDPOINT documented as blank for AWS S3 technical-description
- GitHub Security Advisory (GHSA-qrx8-9hc6-jvqg) vendor-advisory
- Incomplete fix for CVE-2026-32255 patch
- https://github.com/kanbn/kan product
- VulnCheck Advisory: Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment third-party-advisory