Executive brief
Wekan is an open-source Kanban board application used for project management and task tracking. A security vulnerability in the webhook system allows board administrators to provide malicious web addresses that the Wekan server will then attempt to connect to. This could allow an attacker to access sensitive internal company data, such as cloud metadata or internal network services, that are not normally accessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Wekan's webhook integration system due to insufficient input validation. While Wekan contains a 'validateAttachmentUrl' function designed to block private, loopback, and link-local IP ranges, this check was not applied to webhook URLs stored in 'models/integrations.js' or fetched in 'server/notifications/outgoing.js'. An authenticated board administrator can configure a webhook URL pointing to internal resources (such as AWS IMDS at 169.254.169.254 or RFC 1918 addresses). The server then executes requests to these targets when triggering notifications. The vulnerability was fully addressed in version 9.32 by implementing DNS-aware validation on all REST write paths and hardening the delivery layer against DNS rebinding.
Affected products
- Wekan Wekan < 9.32
Timeline
- 2026-05-30: advisory: GitHub Security Advisory published
- 2026-05-31: patched: Version 9.32 released with fixes
- 2026-07-15: disclosed: CVE-2026-53446 published to NVD