EUVD-2026-62701Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Any authenticated board member can trigger the flaw over the network (PR:L, AV:N); scope changes because successful SSRF reaches cloud metadata or internal services beyond Wekan itself (S:C), with high confidentiality impact from potential credential exposure.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery path's fetchSafe guard already blocked the reported IPv4 destination, but its separate IPv4-only resolver and duplicated blocklist created inconsistent all-address-family enforcement and drift risk between input-time and connection-time validation. Version 9.74 makes server/lib/ssrfGuard.js resolve all addresses with dns.lookup({ all: true }), validate every result through the shared isIpBlocked logic, pin the connection, and block redirects. This issue is fixed in version 9.74.
AnalysisAI
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF protections by supplying DNS-resolvable hostnames - such as 169-254-169-254.nip.io resolving to the cloud metadata address 169.254.169.254 - that pass the synchronous string-based blocklist check but reach blocked internal IP ranges at request delivery time. Although the pre-existing delivery-time fetchSafe guard independently blocked the reported proof-of-concept IPv4 cloud metadata target since v8.35/v8.36, the inconsistent dual-validation architecture left IPv6 address family resolution unchecked and maintained a separate, drift-prone blocklist in ssrfGuard.js that could diverge from the input-time validator across software revisions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Wekan session with permission to configure Integrations (outgoing webhooks) on a board - minimally a board member role that has not been restricted from the Integrations UI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) accurately characterizes the theoretical worst case - a scope-changing SSRF with high confidentiality impact where a successful webhook request reaches the cloud instance metadata service and returns IAM role credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Wekan to version 9.74, confirmed fixed via vendor release tag at https://github.com/wekan/wekan/releases/tag/v9.74 and commit ef845fe4a0adb82af436313310939cd48c0b1347 (https://github.com/wekan/wekan/commit/ef845fe4a0adb82af436313310939cd48c0b1347), with full details in the security advisory at https://github.com/wekan/wekan/security/advisories/GHSA-66m2-4wfr-c45p. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Wekan deployments and identify instances running versions 8.36 through 9.73. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Wekan versions 8.31.0 through 8.33 expose webhook URLs and authentication tokens to all board members through unfiltered
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today