CVE-2026-30844: GHSL-2026-045: Server-Side Request Forgery (SSRF) in Wekan - CVE-2026-30844
Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or filtering, affecting both the Wekan and Trello import flows. The parseActivities() and parseActions() methods extract user-controlled attachment URLs, which are then passed directly to Attachments.load() for download with no sanitization. This Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to make the server issue arbitrary HTTP requests, potentially accessing internal network services such as cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network. This issue has been fixed in version 8.34.
Other sources
Wekan v8.32 is vulnerable to a Server-Side Request Forgery (SSRF) flaw (tracked as GHSL-2026-045) that arises from improper handling of attachment URL loading, potentially allowing attackers to manipulate server requests and access internal systems or sensitive data.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30844?
CVE-2026-30844 has been classified as a medium severity vulnerability due to its potential for Server-Side Request Forgery.
How do I fix CVE-2026-30844?
To fix CVE-2026-30844, upgrade Wekan to version 8.34 or later where the vulnerability has been addressed.
Which versions of Wekan are affected by CVE-2026-30844?
Wekan versions 8.32 and 8.33 are affected by CVE-2026-30844.
What type of vulnerability is CVE-2026-30844?
CVE-2026-30844 is a Server-Side Request Forgery (SSRF) vulnerability.
How does the vulnerability CVE-2026-30844 impact Wekan?
CVE-2026-30844 allows an attacker to exploit the lack of validation in attachment URL loading, potentially accessing internal services.