CVE-2026-41455: WeKan < 8.35 SSRF via Webhook URL
WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeKanto a version that resolves this vulnerability.Fixed in 8.35 - Compensating control
Limit/validate webhook integration URLs so the URL scheme and destination are restricted (no arbitrary string schemes and no internal network destinations), to prevent SSRF via webhook URL handling (WeKan < 8.35).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41455?
CVE-2026-41455 is classified as a medium severity vulnerability due to its potential for exploitation through improper handling of webhook URLs.
How do I fix CVE-2026-41455?
To fix CVE-2026-41455, you should upgrade WeKan to version 8.35 or later to mitigate the server-side request forgery vulnerabilities.
What systems are affected by CVE-2026-41455?
CVE-2026-41455 affects WeKan versions prior to 8.35.
What type of vulnerability is CVE-2026-41455?
CVE-2026-41455 is a server-side request forgery (SSRF) vulnerability found in WeKan.
Can CVE-2026-41455 be exploited remotely?
Yes, CVE-2026-41455 can potentially be exploited remotely by attackers with the ability to create or modify webhook integrations.