Key points
- Kanbn versions 0.5.5 through 0.6.0 contain a critical unauthenticated SSRF vulnerability.
- The flaw stems from an incomplete fix for a previous issue, CVE-2026-32255.
- Attackers can access internal services and cloud instance metadata when S3_ENDPOINT is unset.
Kanbn versions 0.5.5 through 0.6.0 contain a critical security flaw that allows unauthenticated attackers to perform server-side request forgery. This vulnerability exists in the /api/download/attatchment route and results from an incomplete remediation of a previous security issue.
What happened
The National Vulnerability Database records CVE-2026-110628 with a CVSS score of 9.2, classifying it as critical. The weakness is identified as CWE-918. According to the record, the flaw affects Kanbn versions 0.5.5 through 0.6.0. The vulnerability resides in the /api/download/attatchment API route. This issue arises because a previous fix for CVE-2026-32255 was not fully effective.
Attackers can exploit this by passing arbitrary URL query parameters to the fetch function. This action occurs when the S3_ENDPOINT configuration variable is unset. The exploit allows the attacker to direct the server to read internal services. It also enables access to localhost ports and cloud instance metadata. The vulnerability requires no authentication for exploitation.
Why it matters
The ability to access cloud instance metadata is significant for organisations using cloud infrastructure. Metadata often contains credentials or configuration details that grant further access. Internal services accessed via localhost ports may expose sensitive data or administrative interfaces. The lack of authentication lowers the barrier for attackers to probe for weaknesses. This makes the vulnerability easily discoverable by automated scanning tools.
The incomplete nature of the previous fix suggests that similar issues may exist elsewhere. Security teams must verify that all related endpoints have been properly secured. The high CVSS score reflects the potential for significant data exposure. Organisations running vulnerable versions face immediate risk of internal network compromise.
What happens next
- Identify all instances of Kanbn running versions 0.5.5 through 0.6.0.
- Check whether the S3_ENDPOINT variable is unset in production environments.
- Monitor logs for unusual requests to the /api/download/attatchment route.
- Prepare to isolate affected systems if no patch is available.
Patch priority
Security operations teams should prioritise systems exposed to the internet or untrusted networks. Check whether vulnerable instances are accessible from external sources first. If a fix is available, test it in a non-production environment before rolling it out. Back up configurations and data prior to applying any updates. If no fix exists, reduce exposure by restricting network access to the API endpoint. Monitor for signs of exploitation, such as unexpected outbound connections.
What to do and how to stay safe: Kanbn
- Scan your infrastructure to identify all installations of Kanbn version 0.6.0 and earlier.
- Verify that the S3_ENDPOINT configuration is correctly set to prevent fallback behaviour.
- Implement network segmentation to limit access to internal services and metadata endpoints.
- Review API logs for requests to the /api/download/attatchment route with unusual parameters.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Kanbn are affected by this vulnerability?
Kanbn versions 0.5.5 through 0.6.0 are affected by CVE-2026-110628.
Is authentication required to exploit this flaw?
No, the vulnerability allows unauthenticated access to internal services and metadata.
What is the CVSS score for this vulnerability?
The CVSS score is 9.2, which is rated as critical.
