PT-2026-34569 · Wekan · Wekan

Rodolphe Ghio + 1 · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-41455

NVD

CVSS v3.1

8.5

High

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41455

Affected Products

Wekan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41455 · Security Note
• https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4 · Patch
• https://github.com/wekan/wekan/releases/tag/v8.35 · Note
• https://vulncheck.com/advisories/wekan-ssrf-via-webhook-url · Note