CVE-2026-30846: GHSL-2026-037: Authentication Token Leak in Wekan - CVE-2026-30846
Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—including sensitive url and token fields—without performing any authentication check on the server side. Although the subscription is normally invoked from the admin settings page, the server-side publication has no access control, meaning any DDP client, including unauthenticated ones, can subscribe and receive the data. This allows an unauthenticated attacker to retrieve global webhook URLs and authentication tokens, potentially enabling unauthorized use of those webhooks and access to connected external services. This issue has been fixed in version 8.34.
Other sources
Wekan v8.31.0 is vulnerable to a global webhook token leak (GHSL-2026-037) due to improper handling of tokens via pubsub, which could allow attackers to access sensitive webhook information. This vulnerability could result in data breaches or unauthorized access.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30846?
CVE-2026-30846 has a moderate severity rating due to the exposure of sensitive webhook integration elements.
How do I fix CVE-2026-30846?
To fix CVE-2026-30846, upgrade Wekan to version 8.34 or later.
What versions of Wekan are affected by CVE-2026-30846?
CVE-2026-30846 affects Wekan versions 8.31.0 through 8.33.
What kind of information is exposed in CVE-2026-30846?
CVE-2026-30846 exposes all global webhook integrations, including sensitive URL and token fields.
Can CVE-2026-30846 lead to further security issues?
Yes, the exposure of webhook tokens can lead to unauthorized access and potentially further security incidents.