CVE-2026-110628: Server-Side Request Forgery (SSRF) in kanbn kan

CVE-2026-110628 is a critical SSRF vulnerability affecting Kan versions 0.5.5 through 0.6.0. It exists in the /api/download/attatchment route due to an incomplete remediation of a prior SSRF flaw (CVE-2026-32255). Specifically, when the S3_ENDPOINT environment variable is not set, the application allows unauthenticated attackers to pass arbitrary URL parameters to the fetch() function. This enables attackers to read internal network services, localhost ports, and cloud instance metadata, potentially exposing sensitive information or enabling further attacks. The vulnerability is remotely exploitable without authentication and requires no user interaction.

An unauthenticated attacker can exploit this SSRF vulnerability to access internal services, localhost ports, and cloud instance metadata. This can lead to unauthorized disclosure of sensitive information and potentially facilitate further attacks within the internal network or cloud environment. The high CVSS score (9.2) reflects the critical nature of this vulnerability and the ease of exploitation.

A patch is available for this vulnerability. Users of Kan versions 0.5.5 through 0.6.0 should apply the official fix provided by the vendor to remediate the SSRF issue. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; users should consult the vendor advisory for confirmation and apply updates accordingly.