Description
Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery path's fetchSafe guard already blocked the reported IPv4 destination, but its separate IPv4-only resolver and duplicated blocklist created inconsistent all-address-family enforcement and drift risk between input-time and connection-time validation. Version 9.74 makes server/lib/ssrfGuard.js resolve all addresses with `dns.lookup({ all: true })`, validate every result through the shared isIpBlocked logic, pin the connection, and block redirects. This issue is fixed in version 9.74.
Published: 2026-08-19
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

From Wekan 8.36 to 9.74, the outgoing webhook URL validator only checked the literal hostname against a regular expression, failing to block DNS names that resolved to internal or blocked IPs. The flaw allows an attacker to supply a DNS‑resolved hostname that maps to an internal address, bypassing the SSRF guard and enabling the server to send arbitrary requests within the network. The vulnerability is a Remote Server‑Side Request Forgery, with an impact on confidentiality and integrity of internal resources.

Affected Systems

Wekan 8.36 through 9.74, deployed on Meteor, are affected. The issue occurs when the outgoing webhook integration URL is validated only against a hostname regular expression, which fails to thwart DNS hostnames that resolve to internal or blocked IPs.

Risk and Exploitability

The CVSS score of 8.5 classifies the issue as High severity, and the EPSS score is not available, indicating that publicly available data on exploitation frequency is lacking. The vulnerability is not entered in CISA’s KEV catalog. Successful exploitation requires creating or editing an outgoing webhook event in Wekan to point at a DNS name that resolves to a target internal address; no additional privileges or network reachability assumptions beyond the ability to configure webhooks are noted. The attack vector is therefore likely through the web application, making the flaw readily exploitable by users who can configure webhooks.

Generated by OpenCVE AI on August 20, 2026 at 12:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Wekan to version 9.74 or later to apply the SSRF guard fix.
  • Restrict outgoing webhook URLs to trusted domains or enforce HTTPS usage where possible.
  • Temporarily disable outgoing webhooks for users that do not require them until a patch is applied.

Generated by OpenCVE AI on August 20, 2026 at 12:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Wekan
Wekan wekan
Vendors & Products Wekan
Wekan wekan

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery path's fetchSafe guard already blocked the reported IPv4 destination, but its separate IPv4-only resolver and duplicated blocklist created inconsistent all-address-family enforcement and drift risk between input-time and connection-time validation. Version 9.74 makes server/lib/ssrfGuard.js resolve all addresses with `dns.lookup({ all: true })`, validate every result through the shared isIpBlocked logic, pin the connection, and block redirects. This issue is fixed in version 9.74.
Title Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Wekan Wekan
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-19T19:44:48.392Z

Reserved: 2026-07-30T19:56:44.102Z

Link: CVE-2026-68558

cve-icon Vulnrichment

Updated: 2026-08-19T19:44:19.315Z

cve-icon NVD

Status : Received

Published: 2026-08-19T20:17:20.910

Modified: 2026-08-19T20:17:20.910

Link: CVE-2026-68558

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T13:00:13Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)