Open-Source Project Management Tool Vulnerability in Kan
CVE-2026-32255

8.6HIGH

Key Information:

Vendor

Kanbn

Status
Kan
Vendor
CVE Published:
18 March 2026

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 20%

What is CVE-2026-32255?

The Kan project management tool has a serious security flaw in its /api/download/attachment endpoint present in versions 0.5.4 and earlier. This vulnerability allows unauthenticated users to pass a URL query parameter directly to the server, which could lead to unintended HTTP requests being made to internal services, cloud metadata endpoints, or other private network resources. This risk exposes sensitive information and system integrity to potential attacks. The issue has been addressed in version 0.5.5. As a precaution, it is recommended to block or restrict access to the endpoint at the reverse proxy level, utilizing tools like nginx or Cloudflare.

Affected Version(s)

kan < 0.5.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

poc-cve-2026-32255
Created by kOaDT

References

https://github.com/kanbn/kan/security/advisories/GHSA-qrx...
x_refsource_CONFIRM
https://github.com/kanbn/kan/commit/53397d8e81dc1494d9413...
x_refsource_MISC
https://github.com/kanbn/kan/releases/tag/v0.5.5
x_refsource_MISC

EPSS Score

20% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.