Server-Side Request Forgery in Kanboard by Kanboard Inc.
CVE-2026-57862

8.4HIGH

Key Information:

Vendor

Kanboard

Status
Kanboard
Vendor
CVE Published:
30 July 2026

What is CVE-2026-57862?

Kanboard versions 1.2.52 and earlier are susceptible to a server-side request forgery vulnerability that allows authenticated users to bypass existing SSRF protections. By inputting hexadecimal IP address notation in user-controlled URLs, attackers can take advantage of the application’s inability to validate this input correctly. This flaw enables them to submit hexadecimal-encoded internal IP addresses via the link creation feature, leading to unintentional connections to internal network resources such as cloud instance metadata services, localhost services, and private RFC1918 addresses. The improper handling of IP validation within the isPrivateURL() filter due to FILTER_VALIDATE_IP only accepting dotted-decimal formats further exacerbates this issue.

Affected Version(s)

Kanboard 0 <= 1.2.52

References

https://github.com/kanboard/kanboard
product
https://gist.github.com/sermikr0/67c8acfc395e465127e729dc...
technical-description
https://www.vulncheck.com/advisories/kanboard-and-prior-s...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saidakbarxon Maxsudxonov
.