Executive brief
Zammad is an open-source helpdesk and customer support platform. A security flaw in its webhook system allows high-privileged users to bypass network restrictions and access internal server data. This could lead to the exposure of sensitive cloud infrastructure metadata or internal service information, potentially compromising the underlying hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Zammad's webhook model due to insufficient validation of destination addresses. While the system checked URL schemes (HTTP/HTTPS) and hostnames, it failed to block loopback (127.0.0.1) or link-local (169.254.164.254) addresses. An attacker with high privileges can configure or trigger webhooks to make requests to these internal addresses, potentially retrieving sensitive metadata from cloud environment APIs (like AWS or GCP metadata services). The vulnerability is resolved in versions 7.0.1 and 6.5.4 by extending validation checks to both webhook configuration and job execution.
Affected products
- Zammad Zammad < 6.5.4, >= 7.0.0-alpha < 7.0.1
Timeline
- 2026-04-08: advisory: Original GitHub Security Advisory published
- 2026-04-08: patched: Fixed versions 7.0.1 and 6.5.4 released
- 2026-04-08: disclosed