WeKan SSRF Vulnerability: Internal Network Exposure Risk

The National Vulnerability Database has detailed CVE-2026-41455, a server-side request forgery (SSRF) vulnerability in WeKan before version 8.35. This flaw resides in the webhook integration URL handling, where the system fails to restrict protocols or validate destination addresses. This isn’t some theoretical bypass; it’s a direct path to internal network interaction.

Attackers who can create or modify integrations can weaponize this by setting webhook URLs to internal network addresses. This forces the WeKan server to issue HTTP POST requests to attacker-controlled targets within the internal network, complete with full board event payloads. The severity is high, rated 8.5 CVSS, indicating a significant risk. The critical aspect here is the potential for unauthorized access to internal services and the ability to overwrite arbitrary comment text without authorization checks, which can be leveraged for obfuscation or further exploitation.

This is a critical blind spot for defenders. The attacker’s calculus is clear: leverage a legitimate application’s functionality to pivot internally. CISOs need to recognize that an application like WeKan, often seen as an internal collaboration tool, can become an attacker’s proxy. The lack of proper validation on webhook URLs turns a feature into a formidable reconnaissance and exploitation vector.