CVE-2026-32255 - Vulnerability Analysis

Overview

Kan <= 0.5.4 contains a server-side request forgery caused by lack of authentication and URL validation in /api/download/attatchment endpoint, letting unauthenticated attackers make arbitrary HTTP requests from the server, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can make arbitrary HTTP requests from the server, potentially accessing internal or cloud metadata services.

Mitigation

Upgrade to version 0.5.5 or later.

References

• https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7
• https://github.com/kanbn/kan/releases/tag/v0.5.5
• https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 19, 2026

🟠 CVE-2026-32255 - High (8.6) Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32255/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/kOaDT/poc-cve-2026-32255

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner