CVE-2026-41455 - Vulnerability Analysis

Overview

WeKan < 8.35 contains a server-side request forgery caused by lack of protocol restriction and destination validation in webhook integration URL handling, letting attackers create or modify integrations to send HTTP POST requests to internal targets and overwrite comments, exploit requires ability to create or modify integrations.

Severity & Score

Impact

Attackers can send HTTP requests to internal network targets and overwrite arbitrary comment text, potentially leading to unauthorized data manipulation and internal network access.

Mitigation

Update to version 8.35 or later.

References

• https://github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4
• https://github.com/wekan/wekan/releases/tag/v8.35
• https://www.vulncheck.com/advisories/wekan-ssrf-via-webhook-url

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner