CVE-2026-110628: Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Kan versions 0.5.5 through 0.6.0 are affected when the S3_ENDPOINT setting is unset. The vulnerable route is /api/download/attatchment.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can supply arbitrary url query parameters to cause the server to make requests through fetch().
What could an attacker access through the vulnerable endpoint?
The issue can be used to read internal services, localhost ports, and cloud instance metadata that the Kan server can reach.
What configuration change may reduce exposure if patching is not immediately possible?
The described vulnerable condition occurs when S3_ENDPOINT is unset. Setting S3_ENDPOINT may avoid that condition, but the provided data does not establish whether this fully mitigates the issue.