Which versions of Zammad are affected by CVE-2026-34719?

Zammad versions before 7.0.1 and 6.5.4 contain a server-side request forgery vulnerability in webhook configuration that permits authenticated administrators to access sensitive cloud provider…. A patch is available.

How to fix or mitigate CVE-2026-34719?

Within 24 hours: inventory all Zammad instances and identify current versions. Within 7 days: apply vendor patch to upgrade to Zammad 7.0.1 or 6.5.4 (or later). Within 30 days: audit administrator accounts for suspicious webhook configurations created in the past 90 days and review cloud provider metadata access logs for unauthorized queries.

Zammad CVE-2026-34719

Q: What is the CVSS score of CVE-2026-34719?

CVE-2026-34719 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20559 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-08 GitHub_M

SSRF Zammad

8.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.0.1,6.5.4

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20559

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 18:02 nvd

HIGH 8.3

DescriptionGitHub Advisory

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses - only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.

AnalysisAI

Server-side request forgery in Zammad webhook implementation allows authenticated administrators to retrieve confidential cloud provider metadata by exploiting insufficient validation of loopback and link-local addresses. Affects versions before 7.0.1 and 6.5.4. Attackers with privileged access can configure malicious webhook URLs targeting internal infrastructure endpoints, bypassing intended URL scheme restrictions. No public exploit identified at time of analysis. CVSS 8.3 reflects high confidentiality and availability impacts on vulnerable and subsequent systems.

Technical ContextAI

CWE-918 SSRF stems from incomplete webhook URL validation checking only HTTP/HTTPS scheme and hostname, missing loopback (127.0.0.0/8, ::1) and link-local (169.254.0.0/16, fe80::/10) address filtering. Exploitation occurs during webhook configuration and job execution phases. Authenticated attack requires PR:H (high privilege administrator access) per CVSS vector.

RemediationAI

Vendor-released patches: upgrade to Zammad 7.0.1 (for 7.x deployments) or 6.5.4 (for 6.x deployments). These versions implement enhanced validation preventing loopback and link-local address access in webhook configurations and job triggers. No workaround exists; upgrading is mandatory to eliminate SSRF vector. Review existing webhook configurations post-upgrade for suspicious internal IP targets. Official security advisory available at https://github.com/zammad/zammad/security/advisories/GHSA-2vgc-vfh2-rw75. Prioritize patching for cloud-hosted instances with access to instance metadata services.