# CVE-2026-41455: WeKan SSRF and unauthorized comment modification in webhooks

Source: https://junglewise.ai/threats/cve-2026-41455-wekan-ssrf-and-unauthorized-comment-modification-in-webhooks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-41455 · Severity: high · CVSS 8.5 · Published 2026-04-22

WeKan is an open-source kanban board application used for project management and collaboration. A security flaw in its webhook system allows users with integration permissions to force the server to send requests to internal network locations. This could lead to the exposure of sensitive internal data or the unauthorized modification of board comments, potentially disrupting business operations and compromising data integrity.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-41455 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41455 being exploited in the wild.

**How severe is CVE-2026-41455?** High severity, with a CVSS score of 8.5, published 22 April 2026.

**Which products and versions are affected?** WeKan < 8.35.

**Is there a fix for CVE-2026-41455?** A patch was published on 2026-03-05: Fixed in version 8.35 and commit 2cd702f48df2b8aef0e7381685f8e089986a18a4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41455 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41455?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in WeKan's webhook integration component due to insufficient validation of the URL scheme and destination. An attacker with privileges to create or modify integrations (PR:L) can provide a malicious URL targeting internal network services. The server will subsequently issue HTTP POST requests containing board event payloads to these internal targets. Furthermore, a flaw in how the server handles responses from these webhooks allows an attacker to overwrite arbitrary comment text without proper authorization checks. This issue is resolved in version 8.35 by implementing protocol restrictions (allowing only HTTP/HTTPS) and blocking private/loopback addresses.

## Affected products

- WeKan WeKan < 8.35

## Timeline

- 2026-03-05: patched: Fixed in version 8.35 and commit 2cd702f48df2b8aef0e7381685f8e089986a18a4
- 2026-04-22: disclosed: Initial advisory publication

## References

- [https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4](https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4)
- [https://github.com/wekan/wekan/releases/tag/v8.35](https://github.com/wekan/wekan/releases/tag/v8.35)
- [https://www.vulncheck.com/advisories/wekan-ssrf-via-webhook-url](https://www.vulncheck.com/advisories/wekan-ssrf-via-webhook-url)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan authentication bypass via X-Forwarded-For spoofing in header-login](https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan missing authorization in cloneBoard method](https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)