CVE-2026-21881

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

• CWE-287

• https://github.com/kanboard/kanboard/commit/7af6143e2ad25b5c15549cca8af4341c7ac4e2fcPatch
• https://github.com/kanboard/kanboard/releases/tag/v1.2.49Release Notes
• https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739wExploit, Vendor Advisory
• https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739wExploit, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21876The OWASP core rule set (CRS) is a set of generic attack det…5.3
• CVE-2026-21877n8n is an open source workflow automation platform. In versi…9.9
• CVE-2026-21878BACnet Stack is a BACnet open source protocol stack C librar…7.5
• CVE-2026-21879Kanboard is project management software focused on Kanban me…6.1
• CVE-2026-2188A vulnerability was determined in UTT 进取 521G 3.1.1-190816. …7.3
• CVE-2026-21880Kanboard is project management software focused on Kanban me…5.3
• CVE-2026-21882theshit is a command-line utility that automatically detects…8.4
• CVE-2026-21883Bokeh is an interactive visualization library written in Pyt…5.4
• CVE-2026-21884React Router is a router for React. In @remix-run/react vers…8.2
• CVE-2026-21885Miniflux 2 is an open source feed reader. Prior to version 2…6.5
• CVE-2026-21886OpenCTI is an open source platform for managing cyber threat…8.1
• CVE-2026-21887OpenCTI is an open source platform for managing cyber threat…7.7