Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
Kan Project Management Tool: Unauthenticated Server-Side HTTP Requests
CVE-2026-32255
Summary
Versions 0.5.4 and below of the Kan project management tool allow an attacker to make unauthorized server-side requests to internal services, cloud metadata, or private networks. This can lead to data exposure or unauthorized access. To mitigate this, update to version 0.5.5 or block access to the affected endpoint at your reverse proxy server.
Original title
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint acce...
Original description
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).
nvd CVSS3.1
8.6
Vulnerability type
CWE-918
Server-Side Request Forgery (SSRF)
Published: 19 Mar 2026 · Updated: 19 Mar 2026 · First seen: 19 Mar 2026