Is CVE-2026-57862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57862 being exploited in the wild.

How severe is CVE-2026-57862?

High severity, with a CVSS score of 8.5, published 30 July 2026.

Is there a fix for CVE-2026-57862?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57862 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57862?

Check whether you run Kanboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57862: Kanboard SSRF filter bypass via hexadecimal IP notation

CVE-2026-57862 · Severity: high · CVSS 8.5 · Published 2026-07-30

Kanboard, a project management tool, contains a security flaw that allows logged-in users to trick the server into making unauthorized requests to internal systems. By using a specific web link format, an attacker can bypass security filters to access private data, such as cloud infrastructure credentials or internal databases not intended for public access. This could lead to a full takeover of the organization's cloud environment or exposure of sensitive internal services.

Technologies: Kanboard. Vendors: Kanboard.

Quick answers

Is CVE-2026-57862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57862 being exploited in the wild.
How severe is CVE-2026-57862?: High severity, with a CVSS score of 8.5, published 30 July 2026.
Which products and versions are affected?: Kanboard <= 1.2.52.
Is there a fix for CVE-2026-57862?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57862 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57862?: Check whether you run Kanboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Kanboard's 'isPrivateURL()' filter within 'app/Core/Http/Client.php'. The filter relies on 'FILTER_VALIDATE_IP', which fails to recognize hexadecimal IP notation (e.g., 0x7f000001) as a valid IP address, causing it to return false and bypass private range checks. However, the underlying cURL library natively resolves these hexadecimal strings. An authenticated attacker can exploit this via the web link creation feature to reach internal resources, including RFC1918 addresses and Cloud Instance Metadata Services (IMDS). This can result in the exfiltration of sensitive metadata or IAM credentials. As of the advisory date, the vulnerability remains unpatched in version 1.2.52.

Affected products

Kanboard Kanboard <= 1.2.52

Timeline

2026-07-18: disclosed: Vulnerability reported by Saidakbarxon Maxsudxonov
2026-07-30: advisory: CVE-2026-57862 published by VulnCheck/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.