CVE-2026-57862

Deferred Deferred - Pending Action

SSRF Bypass via Hexadecimal IP in Kanboard

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php incorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-57862

EUVD

EUVD-2026-51164

Affected Vendors & Products

Vendor	Product	Version / Range
kanboard	kanboard	to 1.2.52 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Kanboard 1.2.52 and prior has a server-side request forgery (SSRF) vulnerability. Authenticated users can bypass SSRF protections by using hexadecimal IP address notation in URLs. This tricks the system into connecting to internal network resources like cloud metadata services or localhost, which the SSRF filter incorrectly allows due to improper input validation.

Detection Guidance

Check Kanboard logs for unusual URL requests containing hexadecimal IP addresses. Inspect network traffic for outbound connections to internal IPs from Kanboard processes. Use tools like curl with hex IP notation to test if SSRF protections are bypassed.

Impact Analysis

An attacker with authenticated access could exploit this to access internal systems, steal sensitive data, or perform unauthorized actions on internal services. This could lead to data breaches, service disruption, or further network compromise depending on the internal resources exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected Kanboard versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Kanboard to version 1.2.53 or later. Implement strict input validation to reject non-dotted-decimal IP formats. Configure network firewalls to block outbound connections to internal IPs from Kanboard servers.

Hi! I’m here to help you understand CVE-2026-57862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70