# CVE-2026-67530: ArnasDon WACRM SSRF in automation send_webhook action

Source: https://junglewise.ai/threats/cve-2026-67530-arnasdon-wacrm-ssrf-in-automation-send-webhook-action  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67530 · Severity: medium · CVSS 6.4 · Published 2026-07-30

WACRM, a self-hostable customer relationship management (CRM) tool for WhatsApp, contains a security flaw in its automation system. An authorized user can configure the system to send automated webhooks to internal network addresses that should normally be inaccessible. This could allow an attacker to probe internal services or access sensitive cloud metadata, potentially leading to further compromise of the hosting environment.

Technologies: [ArnasDon WACRM](https://junglewise.ai/threats/technologies/wacrm). Vendors: [ArnasDon](https://junglewise.ai/threats/vendors/arnasdon).

## Quick answers

**Is CVE-2026-67530 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67530 being exploited in the wild.

**How severe is CVE-2026-67530?** Medium severity, with a CVSS score of 6.4, published 30 July 2026.

**Which products and versions are affected?** ArnasDon WACRM <= 0.7.0.

**Is there a fix for CVE-2026-67530?** A patch was published on 2026-07-30: Fix merged via commit 23838a9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67530 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-67530?** Check whether you run ArnasDon WACRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in WACRM versions 0.7.0 and earlier within the automation engine. The 'send_webhook' action in 'src/lib/automations/engine.ts' and its associated validation logic in 'src/lib/automations/validate.ts' fail to implement the 'isDeliverableUrl' guard used elsewhere in the application. An authenticated user with automation privileges can submit a crafted webhook URL pointing to loopback, link-local (such as 169.254.169.254), or private network addresses. The server will then execute a POST request to these addresses, potentially exposing internal service status codes or cloud metadata. The issue is resolved in commit 23838a9959550e975d732ae08a44a3a2f0cc084b by enforcing the SSRF guard and restricting redirects.

## Affected products

- ArnasDon WACRM <= 0.7.0

## Timeline

- 2026-07-08: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE published to NVD
- 2026-07-30: patched: Fix merged via commit 23838a9

## References

- [https://github.com/ArnasDon/wacrm/commit/23838a9959550e975d732ae08a44a3a2f0cc084b](https://github.com/ArnasDon/wacrm/commit/23838a9959550e975d732ae08a44a3a2f0cc084b)
- [https://github.com/ArnasDon/wacrm/security/advisories/GHSA-8jqh-598v-rfxc](https://github.com/ArnasDon/wacrm/security/advisories/GHSA-8jqh-598v-rfxc)

## Related threats

- [WACRM database authorization bypass in profiles and AI knowledge](https://junglewise.ai/threats/cve-2026-77240-wacrm-is-a-self-hostable-crm-template-for-whatsapp-in-version-0-7)
- [WACRM authorization bypass in automation engine](https://junglewise.ai/threats/cve-2026-49141-wacrm-authorization-bypass-in-automation-engine)