CVE-2026-110628 kanbn CVE debrief

Who should care

Defenders responsible for Kan instances, especially those with S3_ENDPOINT unset, should assess exposure and apply patches or compensating controls to mitigate SSRF risks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the presence of affected systems in their environments and prioritize remediation efforts. Additionally, security teams should review and update their monitoring and 

Why it matters

CVE-2026-110628 is a critical unauthenticated SSRF vulnerability in Kan 0.5.5-0.6.0, allowing attackers to access internal services and metadata when S3_ENDPOINT is unset. Defenders should prioritize verifying exposure and applying patches or compensating controls.

• Potential unauthorized access to internal services and metadata
• Risk of sensitive information disclosure
• Possible disruption of internal services
• Need for verification of instance exposure and patch application

Technical summary

The vulnerability is caused by an incomplete fix for CVE-2026-32255 in Kan 0.5.5 through 0.6.0. When S3_ENDPOINT is unset, attackers can pass arbitrary URL query parameters to the fetch() function, allowing them to read internal services, localhost ports, and cloud instance metadata. This SSRF vulnerability can lead to unauthorized access to sensitive information and internal systems. Defenders should assess the exposure of Kan instances, especially those with S3_ENDPOINT unset, and apply patches or compensating controls to mitigate SSRF risks. The CVE record and source item provide details on the vulnerability, affected versions, and references to patches and advisories.

Defensive priority

Defenders should prioritize verifying exposure of Kan instances, especially those with S3_ENDPOINT unset, and apply patches or compensating controls to mitigate SSRF risks.

Recommended defensive actions

• Verify Kan instance exposure, especially with S3_ENDPOINT unset
• Apply patches or updates to affected versions
• Implement compensating controls to mitigate SSRF risks
• Monitor for suspicious activity related to /api/download/attatchment
• Review and update asset inventory to identify potentially exposed systems
• Perform thorough vulnerability scanning and penetration testing to assess exposure
• Establish a change window for applying patches or mitigations

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to patches and advisories. However, specific exploitation instances or business impacts are not documented.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.