Executive brief
Kanboard, a project management tool, contains a security flaw that allows logged-in users to trick the server into making unauthorized requests to internal systems. By using a specific web link format, an attacker can bypass security filters to access private data, such as cloud infrastructure credentials or internal databases not intended for public access. This could lead to a full takeover of the organization's cloud environment or exposure of sensitive internal services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Kanboard's 'isPrivateURL()' filter within 'app/Core/Http/Client.php'. The filter relies on 'FILTER_VALIDATE_IP', which fails to recognize hexadecimal IP notation (e.g., 0x7f000001) as a valid IP address, causing it to return false and bypass private range checks. However, the underlying cURL library natively resolves these hexadecimal strings. An authenticated attacker can exploit this via the web link creation feature to reach internal resources, including RFC1918 addresses and Cloud Instance Metadata Services (IMDS). This can result in the exfiltration of sensitive metadata or IAM credentials. As of the advisory date, the vulnerability remains unpatched in version 1.2.52.
Affected products
- Kanboard Kanboard <= 1.2.52
Timeline
- 2026-07-18: disclosed: Vulnerability reported by Saidakbarxon Maxsudxonov
- 2026-07-30: advisory: CVE-2026-57862 published by VulnCheck/NVD