Kan CVE-2026-110628

Exploitable only when the S3_ENDPOINT environment variable is unset/blank - which the project's own .env.example documents as the intended configuration for AWS S3 deployments, making it a realistic default rather than an edge case. In that state the pre-patch attatchment.ts bypassed hostname validation entirely and passed the attacker-supplied url query parameter directly to fetch(). Limiting factor: instances configured with a non-empty S3_ENDPOINT (MinIO, Cloudflare R2, DigitalOcean Spaces) enforced a hostname allowlist and were not vulnerable through this path. No authentication is required (PR:N), and no user interaction is needed; the route is reachable by remote unauthenticated attackers behind only a rate limit.

This is a genuine high-priority issue for affected Kan deployments, not an inflated CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the VC:H/SC:H impact reflects reading internal services and - critically - cloud instance metadata (e.g., 169.254.169.254 IAM credentials), which can cascade into cloud account compromise. CWE-918 SSRF matches the technical description precisely. Two signals are notably ABSENT from the input and should temper urgency: there is no EPSS score provided and no CISA KEV listing, so exploitation probability and in-the-wild activity are unquantified here. A public technical write-up (hackmd) and a VulnCheck advisory exist, which lowers the research bar for attackers, but the input does not flag confirmed exploit code, so this should be treated as no confirmed public exploit with a disclosed methodology. The one meaningful caveat: this is explicitly an INCOMPLETE FIX for CVE-2026-32255 and is only exploitable when S3_ENDPOINT is unset - the documented default for AWS S3 setups - so real risk is conditional on deployment configuration rather than universal across all Kan installs.

An attacker locates an internet-exposed Kan instance (0.5.5-0.6.0) configured for AWS S3 with S3_ENDPOINT left blank, then sends an unauthenticated GET to /api/download/attatchment supplying a url parameter such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. Because the pre-patch code skipped URL validation entirely when S3_ENDPOINT was unset, the server's fetch() retrieves the target and returns internal/metadata content to the attacker. A public technical write-up and VulnCheck advisory describe the method, though the input does not confirm packaged exploit code.