Is CVE-2026-110628 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110628?

CVE-2026-110628 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-110628

Description

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.