CVE-2026-32255

Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint

No known exploitation. EPSS puts it in the 78th percentile. Fixed in 0.5.5.

CVSS 3.18.6High EPSS percentile78th1.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix0.5.5Upgrade to this build

Published 2026-03-18Updated 2026-03-19Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Kanbn KanAffected: < 0.5.5Upgrade to: not statedStated by: CVE record
KanAffected: < 0.5.5Upgrade to: 0.5.5Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

In plain language

Written by AI from the record

CVE-2026-32255 is a Kan web-app bug where anyone (even without an account) can trick the server into fetching a URL for them, potentially reaching internal systems; if you run Kan version 0.5.4 or older, you should upgrade to 0.5.5.

Unauthenticated SSRF in Kan’s attachment download endpoint (CWE-918): the /api/download/attatchment endpoint accepts a user-controlled URL parameter and server-side fetches it without authentication or URL validation, allowing attackers to reach internal network services. Fixed in kan 0.5.5.

If you're affected

Internal systems reachable from web
Sensitive data exposure risk
Cloud metadata access risk
Service disruption risk

What is it

Kan normally downloads files as part of project work. This bug lets an outsider skip all logins and tell Kan to fetch a URL on their behalf. With careful URLs, that can make the Kan server contact internal-only services (and potentially expose sensitive information).

Who is affected

This matters if you run the open-source project management tool Kan (kan) and your version is 0.5.4 or below. It’s a risk because the vulnerable endpoint can be reached without authentication, so an attacker only needs network access to your Kan server (for example, the internet or any exposed network path) to try the request.

How urgent is it

This is an AMBER issue because it is unauthenticated and directly enables the server to make requests to internal resources. Even if exploitation details aren’t confirmed via CISA KEV, the attack path is straightforward and the likelihood is considered rising. Prioritize upgrading to the fixed version now.

What to do — in detail

Confirm exposure: Identify the Kan version you are running. If it’s kan 0.5.4 or below, you are exposed.
Upgrade to the fix (preferred): Upgrade Kan to kan 0.5.5.
If you cannot upgrade yet (temporary mitigation): At the reverse proxy layer (nginx, Cloudflare, etc.), block or restrict access to the vulnerable path /api/download/attatchment. This prevents unauthenticated access to the SSRF-capable endpoint while you plan the upgrade.
Validate after changes: After upgrading or applying the reverse-proxy restriction, test the attachment download functionality you rely on (for legitimate users) while ensuring that requests to /api/download/attatchment from unauthorized sources are blocked.
What to monitor: Watch for unusual outbound-looking requests originating from the Kan server and for spikes in requests targeting /api/download/attatchment.

Technical context

Severity is high (CVSS 8.6) with a mechanism of unauthenticated SSRF (CWE-918). In affected versions (0.5.4 and below), /api/download/attatchment accepts a user-supplied URL query parameter and uses it directly in a server-side fetch(), with no authentication and no URL validation. Impact scope includes potential access to internal network services and sensitive endpoints (e.g., cloud metadata or private resources). No CISA KEV entry is listed for this CVE. Exploit maturity is indicated as “detection template only” (weaponization details not confirmed here). Predicted likelihood (EPSS) is reported as 19.0% with a rising trend, but exploitation confirmation from KEV/news is not present in the findings provided. Fixed in kan 0.5.5 (per vendor patch details and remediation links).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS78th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.7% chance of exploitation activity in the next 30 days, which ranks it in the 78th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

18 events over 196 days, from the signal feeds we watch.

2026-09-30EPSS band changemoderate → low
2026-09-24EPSS band changemoderate → lowepss band change
2026-08-24EPSS band changelow → moderate
2026-08-20EPSS band change0 → moderateepss band change
2026-08-19Nuclei check added
2026-08-17EPSS band changemoderate → low

Affected products

kan
- kan
kanbn
- kan

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Scored 8.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact