PT-2026-34569 · Wekan · Wekan

Rodolphe Ghio + 1 · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-41455

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.35

Description An issue exists in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. This allows users with permissions to create or modify integrations to set webhook URLs to internal network addresses. Consequently, the server may issue HTTP POST requests to internal targets with full board event payloads. Additionally, the response handling can be exploited to overwrite arbitrary comment text without authorization checks. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 8.35 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41455

Affected Products

Wekan

References · 5

• https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41455 · Security Note
• https://github.com/wekan/wekan/releases/tag/v8.35 · Note
• https://vulncheck.com/advisories/wekan-ssrf-via-webhook-url · Note
• https://twitter.com/CVEnew/status/2047359937118929123 · Twitter Post