What is the CVSS score of CVE-2026-15732?

CVE-2026-15732 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WGDashboard are affected by CVE-2026-15732?

WGDashboard versions 4.2.3 and earlier contain a critical Server-Side Request Forgery vulnerability (CVSS 9.8) in webhook functionality that enables arbitrary HTTP requests from the server with full…

Is there a public PoC exploit available for CVE-2026-15732?

Yes, a public proof-of-concept exploit is available for CVE-2026-15732. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-15732?

Within 24 hours: Identify all WGDashboard instances in production and document their current versions; immediately restrict network access to WGDashboard administrative interfaces to authorized IP ranges only and disable webhook functionality if operationally feasible. Within 7 days: Contact WGDashboard vendor to clarify authentication requirements (CVSS indicates PR:N/unauthenticated; description states authenticated) and request interim security guidance; implement Web Application Firewall or network-level monitoring to detect anomalous outbound connections from WGDashboard; enable comprehensive logging of all webhook configuration and execution events. Within 30 days: Deploy the vendor security patch immediately upon release; conduct forensic analysis of webhook logs for indicators of SSRF exploitation attempts; implement network segmentation to isolate WGDashboard from sensitive internal systems and databases.

WGDashboard CVE-2026-15732

EUVD-2026-54245 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-06 cret@cert.org

GHSA-89hj-33q6-8644

SSRF

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Description gates the webhook behind authentication so PR:L not PR:N; full-read SSRF gives high confidentiality, limited integrity from arbitrary requests, and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 17:22 vuln.today

CVSS changed

Aug 07, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.8

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.

AnalysisAI

Server-Side Request Forgery in WGDashboard (WireGuard management dashboard) version 4.2.3 and earlier (EUVD extends the range through 4.3.2) lets attackers abuse the webhook functionality to make arbitrary HTTP requests from the server and read back full responses. The description scopes this to authenticated attackers, though the supplied CVSS vector marks it PR:N (unauthenticated) - a discrepancy defenders should resolve with the vendor. Publicly available exploit code exists (Stuub PoC), but EPSS is only 0.16% (6th percentile) and there is no public exploit identified as actively exploited.

Technical ContextAI

WGDashboard is an open-source Python/Flask web UI for managing WireGuard VPN configurations. The flaw is a classic CWE-918 Server-Side Request Forgery in its webhook feature: user-influenced destinations are used to originate HTTP requests server-side without adequate validation of the target host/URL, and critically the full response body is returned to the requester (a 'full-read' SSRF rather than blind SSRF). This lets an attacker pivot the WGDashboard server into internal networks, reaching cloud metadata endpoints (e.g., 169.254.169.254), internal admin interfaces, or link-local services that are otherwise unreachable from outside.

RemediationAI

No vendor-released patch version was identified at time of analysis; the input provides no fixed release tag. Monitor the project repository (https://github.com/WGDashboard/WGDashboard) and the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-15732) for a fixed release above 4.3.2 and upgrade as soon as it is published. As compensating controls until then: restrict who can configure webhooks (limit dashboard accounts and enforce strong authentication, since the description indicates an authenticated feature); place the WGDashboard host behind egress filtering that blocks outbound requests to internal RFC1918 ranges, link-local 169.254.169.254 cloud metadata, and localhost, so SSRF cannot reach sensitive internal targets; and if the webhook feature is unused, disable it entirely. Trade-offs: egress filtering can break legitimate outbound webhook deliveries to intended external endpoints, and disabling webhooks removes any notification integrations that depend on them.