CVE-2026-110628 in Kaninfo

Zusammenfassung

von MITRE • 14.10.2026

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Zuständig

VulnCheck

Reservieren

14.10.2026

Veröffentlichung

14.10.2026

Moderieren

akzeptiert

Eintrag

VDB-420058

CPE

20261014

CWE

CWE-918 (bestätigt)

CVSS

8.6 (CNA)

EPSS

0.00000

KEV

nein

Aktivitäten

very low

Quellen

MITRE	https://www.cve.org/CVERecord?id=CVE-2026-110628
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-110628
CVE Details	https://www.cvedetails.com/cve/CVE-2026-110628/

◂ Zurück Übersicht Weiter ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!