Unauthenticated SSRF in Kan via Incomplete Fix

Executive Summary

CVE-2026-110628 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the Kan application affecting versions 0.5.5 through 0.6.0. The flaw exists in the /api/download/attachment endpoint which allows attackers to pass arbitrary URL parameters to the fetch() function when the S3_ENDPOINT environment variable is unset. This enables access to internal services, localhost ports, and cloud instance metadata. The vulnerability stems from an incomplete fix for CVE-2026-32255.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Kan application is running versions 0.5.5 through 0.6.0. Verify if the S3_ENDPOINT environment variable is unset. Test the /api/download/attatchment endpoint by sending a GET request with a malicious URL parameter to see if it returns internal service data or cloud metadata. Use curl commands like: curl 'http://<target>/api/download/attatchment?url=http://localhost:22' or curl 'http://<target>/api/download/attatchment?url=http://169.254.169.254/latest/meta-data/'.

If the endpoint responds with data from internal services or cloud metadata, the system is vulnerable. Ensure proper logging is enabled to capture such requests for further investigation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read internal services, localhost ports, and cloud instance metadata. It can lead to confidentiality breaches, chained cloud account compromises, and memory exhaustion via large file downloads. Attackers can access sensitive internal data without authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to internal services, cloud metadata, and sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. The SSRF flaw allows attackers to exfiltrate data, violating confidentiality requirements in both standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Kan to a version beyond 0.6.0 where the vulnerability is fixed. Ensure the S3_ENDPOINT environment variable is properly configured to restrict URL access. Block or restrict access to the /api/download/attatchment endpoint at the reverse proxy level (e.g., nginx or Cloudflare).

Disable the endpoint if not required. Implement strict URL validation and authentication checks for all API endpoints. Monitor network traffic for suspicious requests to the affected endpoint.

Useful 0 Not Useful 0