Open-Source Project Management Tool Vulnerability in Kan
CVE-2026-32255

8.6HIGH

Key Information:

Vendor: Kanbn
Status: Kan
Vendor: CVE Published:; 18 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-32255?

The Kan project management tool has a serious security flaw in its /api/download/attachment endpoint present in versions 0.5.4 and earlier. This vulnerability allows unauthenticated users to pass a URL query parameter directly to the server, which could lead to unintended HTTP requests being made to internal services, cloud metadata endpoints, or other private network resources. This risk exposes sensitive information and system integrity to potential attacks. The issue has been addressed in version 0.5.5. As a precaution, it is recommended to block or restrict access to the endpoint at the reverse proxy level, utilizing tools like nginx or Cloudflare.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

kan < 0.5.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

poc-cve-2026-32255
Created by kOaDT