CyberSecBulletin

Kanbn vulnerabilities

We track 2 vulnerabilities in Kanbn products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.

2vulnerabilities
0critical
2high
0exploited
8.6average CVSS score

Latest Kanbn vulnerabilities

  • 8.6 High severity

    kan: Server-Side Request Forgery

    CVE-2026-110628Kanbn

    Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fe

  • 8.6 High severity

    kan: Server-Side Request Forgery

    CVE-2026-32255KanbnEPSS 28.5%

    Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly