Kanboard 1.2.52 and prior are affected by an SSRF vulnerability (CVE-2026-57862) where authenticated users can bypass SSRF protections by supplying hexadecimal IP addresses in user-controlled URLs. The vulnerability exists because the isPrivateURL() filter in app/Core/Http/Client.php uses FILTER_VALIDATE_IP, which rejects non-dotted-decimal notation, causing the filter to incorrectly consider hexadecimal IP addresses safe. This allows cURL to resolve and connect to internal network resources, including cloud instance metadata services, localhost, and RFC1918 addresses, potentially exposing sensitive internal services.

Authenticated attackers can exploit this vulnerability to bypass SSRF protections and make server-side requests to internal network resources that are normally protected. This could lead to unauthorized access to sensitive internal services such as cloud metadata endpoints and localhost services, potentially exposing confidential information or enabling further attacks within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user capabilities to submit URLs or implement additional validation to detect and block hexadecimal IP address notation in URLs. Monitor vendor channels for updates and apply patches promptly once released.