# CVE-2026-34719: Zammad SSRF in webhook model

Source: https://junglewise.ai/threats/cve-2026-34719-zammad-ssrf-in-webhook-model  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34719 · Severity: medium · CVSS 4.3 · Published 2026-04-08

Zammad is an open-source helpdesk and customer support platform. A security flaw in its webhook system allows high-privileged users to bypass network restrictions and access internal server data. This could lead to the exposure of sensitive cloud infrastructure metadata or internal service information, potentially compromising the underlying hosting environment.

Technologies: [Zammad](https://junglewise.ai/threats/technologies/zammad). Vendors: [Zammad](https://junglewise.ai/threats/vendors/zammad).

## Quick answers

**Is CVE-2026-34719 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34719 being exploited in the wild.

**How severe is CVE-2026-34719?** Medium severity, with a CVSS score of 4.3, published 8 April 2026.

**Which products and versions are affected?** Zammad < 6.5.4, >= 7.0.0-alpha < 7.0.1.

**Is there a fix for CVE-2026-34719?** A patch was published on 2026-04-08: Fixed versions 7.0.1 and 6.5.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34719 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34719?** Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Zammad's webhook model due to insufficient validation of destination addresses. While the system checked URL schemes (HTTP/HTTPS) and hostnames, it failed to block loopback (127.0.0.1) or link-local (169.254.164.254) addresses. An attacker with high privileges can configure or trigger webhooks to make requests to these internal addresses, potentially retrieving sensitive metadata from cloud environment APIs (like AWS or GCP metadata services). The vulnerability is resolved in versions 7.0.1 and 6.5.4 by extending validation checks to both webhook configuration and job execution.

## Affected products

- Zammad Zammad < 6.5.4, >= 7.0.0-alpha < 7.0.1

## Timeline

- 2026-04-08: advisory: Original GitHub Security Advisory published
- 2026-04-08: patched: Fixed versions 7.0.1 and 6.5.4 released
- 2026-04-08: disclosed

## References

- [https://github.com/zammad/zammad/security/advisories/GHSA-2vgc-vfh2-rw75](https://github.com/zammad/zammad/security/advisories/GHSA-2vgc-vfh2-rw75)

## Related threats

- [Zammad stored cross-site scripting in ticket article rendering](https://junglewise.ai/threats/cve-2026-102345-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the)
- [Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack)
- [Zammad S/MIME signature verification bypass allows sender impersonation](https://junglewise.ai/threats/cve-2026-84465-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad unauthorized data access in External Data Source](https://junglewise.ai/threats/cve-2026-84464-zammad-is-a-web-based-open-source-helpdesk-customer-support)