{"id":"CVE-2026-110628","revision":"f042385601634c30b3cf4e417f756c91","records":[{"revision":"f042385601634c30b3cf4e417f756c91","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110628","aliases":[],"title":"Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment","description":"Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.","state":0,"publishedAt":"2026-10-14T14:17:03.232+00:00","modifiedAt":"2026-10-16T17:16:01.554+00:00","affected":[{"ecosystem":"https://github.com","name":"kan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kanbn\",\n                    \"product\": \"kan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.5.5\",\n                            \"lessThanOrEqual\": \"0.6.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"collectionURL\": \"https://github.com\",\n                    \"packageURL\": \"pkg:github/kanbn/kan\",\n                    \"repo\": \"https://github.com/kanbn/kan\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":9.2,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6,"severity":"HIGH"}],"references":["https://hackmd.io/@leediay/HyIxU63ofg","https://github.com/kanbn/kan/pull/590","https://github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52","https://github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27","https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg","https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7","https://github.com/kanbn/kan","https://www.vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchment"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110628","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110628","identifiers":["CVE-2026-110628"]},"retained":false,"historicalAffected":[]}],"coverage":[]}