Kanban Unauthenticated SSRF Flaw in v0.6.0 Exposes Cloud Metadata Due to Incomplete CVE Fix

Kanban versions 0.5.5 through 0.6.0 contain an unauthenticated server-side request forgery vulnerability. This flaw allows attackers to access internal network resources and cloud metadata without valid credentials.

What happened

The National Vulnerability Database records CVE-2026-110628 as a critical severity issue with a CVSS score of 9.2. The flaw exists in the /api/download/attatchment API endpoint. It results from an incomplete fix for the previously disclosed CVE-2026-32255. According to the NVD record, the weakness maps to CWE-918, which covers server-side request forgery. The vulnerability is present in Kanban releases from version 0.5.5 up to and including version 0.6.0.

Why it matters

The exploit condition relies on the S3_ENDPOINT configuration variable being unset. When this variable is empty, the application fails to validate URL parameters passed to the fetch() function. Attackers can supply arbitrary URL query parameters through the vulnerable route. This allows them to direct the server to fetch data from internal services. They can also target localhost ports on the hosting machine. Furthermore, the flaw enables access to cloud instance metadata endpoints. This exposure occurs without any form of authentication.

What to watch

• Check if your Kanban instance version falls between 0.5.5 and 0.6.0.
• Verify whether the S3_ENDPOINT environment variable is configured in your deployment.
• Monitor the /api/download/attatchment endpoint for unusual query parameters.
• Look for outbound connections from the application server to internal IP ranges.

Signals worth monitoring

Security operations teams usually review outbound connection logs from application servers to detect server-side request forgery. Analysts often filter for requests originating from web service ports to internal IP ranges or localhost addresses. Teams typically check for connections to well-known cloud metadata endpoints, which often trigger alerts in network monitoring tools. Incident responders usually isolate the affected host immediately upon confirming unauthorized internal access. They often review application logs for unusual query parameters in API calls that involve file downloads or external resource fetching.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Kanban

• Identify all running instances of Kanban version 0.5.5 through 0.6.0 in your environment.
• Ensure the S3_ENDPOINT configuration variable is set to a valid value, even if not actively using S3.
• Restrict network access from the application server to internal services and cloud metadata endpoints.
• Monitor server logs for unauthorized requests to the /api/download/attatchment route.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Kanban are affected by CVE-2026-110628?

Kanban versions 0.5.5 through 0.6.0 are affected by this unauthenticated server-side request forgery vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.2, rating the severity as Critical.

Does this vulnerability require authentication to exploit?

No, the vulnerability is unauthenticated, allowing attackers to exploit it without valid credentials.