CVE-2026-21881 CRITICAL

CVE-2026-21881: Kanboard is Vulnerable to Reverse Proxy Authentication Bypass

Vendor Kanboard
Product kanboard
Weakness CWE-287 · Improper authentication
Published January 8, 2026
Last update January 8, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

Key dates

02Disclosure timeline

January 8, 2026 CVE published
January 8, 2026 Record updated