{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akankan0.5.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kan:kan:0.5.5:*:*:*:*:*:*:*","cpe:2.3:a:kan:kan:0.6.0:*:*:*:*:*:*:*","cpe:2.3:a:kan:kan:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-32255"},{"cvss":8.6,"id":"CVE-2026-110628"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kan (0.5.5 - 0.6.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","ssrf","cloud-security"],"_cs_type":"advisory","_cs_vendors":["Kan"],"content_html":"\u003cp\u003eKan versions 0.5.5 through 0.6.0 are affected by an unauthenticated server-side request forgery (SSRF) vulnerability located in the /api/download/attatchment route. This vulnerability arises from an incomplete remediation of CVE-2026-32255. When the S3_ENDPOINT environment variable is not configured, the application fails to properly validate parameters passed to the internal fetch() function. An unauthenticated attacker can exploit this to submit arbitrary URLs as query parameters, forcing the application server to make requests on their behalf. This permits the exfiltration of sensitive information, such as cloud instance metadata (e.g., AWS/GCP/Azure IMDS endpoints), and enables scanning of the internal network for reachable services and open ports. Defenders should treat this as a high-priority risk if the affected Kan instances are deployed within cloud environments or have access to sensitive internal network segments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote, unauthenticated attackers to bypass network perimeters, potentially leading to the compromise of cloud instance credentials, unauthorized access to internal administrative interfaces, or the discovery of internal network topography. The vulnerability exposes any internal resource accessible from the server's network location.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade to a patched version of Kan or configure the S3_ENDPOINT environment variable to an authenticated, trusted endpoint to neutralize the vulnerability trigger.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to /api/download/attatchment that contain internal IP addresses (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) in the query parameters.\u003c/li\u003e\n\u003cli\u003eRestrict the outbound network access of the Kan application server to only authorized external endpoints to prevent exploitation of the SSRF for internal network probing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:37:12Z","date_published":"2026-10-14T16:37:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kan-ssrf/","summary":"Kan versions 0.5.5 through 0.6.0 contain an unauthenticated SSRF vulnerability in the /api/download/attatchment endpoint that allows attackers to probe internal services and cloud metadata.","title":"Unauthenticated SSRF in Kan API Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-10-kan-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kan:kan:0.5.5:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}