CVE-2026-32255

Kan, an open-source project management tool, contains an unauthenticated server-side request forgery (SSRF, CWE-918) in its /api/download/attatchment endpoint in versions 0.5.4 and earlier. Because the endpoint accepts a user-supplied URL query parameter and passes it directly to a server-side fetch() call with no authentication and no URL validation, any attacker who can reach the endpoint can make the server issue arbitrary HTTP requests. The server returns the full response body to the attacker, allowing them to read internal services, cloud instance metadata endpoints, and other private network resources, which is reflected in the CVSS scope change and high confidentiality impact (no integrity or availability impact). All deployments running Kan 0.5.4 or earlier are affected, with risk concentrated in instances reachable from the internet or from untrusted networks. No public proof-of-concept or confirmed in-the-wild exploitation is known, although the 20.8% EPSS score (97th percentile) indicates a meaningful probability of exploitation within the next 30 days.

What to do: Upgrade to Kan 0.5.5, which fixes the vulnerable endpoint. If upgrading is not immediately possible, block or restrict access to /api/download/attatchment at the reverse proxy (e.g., nginx, Cloudflare). Review proxy and application logs for unauthenticated requests to that path, and consider restricting server-side egress to cloud metadata endpoints as defense in depth.