CVE-2026-1884 Overview
CVE-2026-1884 is a server-side request forgery (SSRF) vulnerability affecting ZenTao project management software up to version 21.7.6-85642. The flaw resides in the fetchHook function within module/webhook/model.php, part of the Webhook Module. An authenticated attacker with high privileges can manipulate webhook requests to force the server to issue arbitrary outbound HTTP requests. The vulnerability was publicly disclosed through community channels, and the vendor did not respond to disclosure attempts. The exploit is publicly available, but exploitation requires existing privileges on the ZenTao instance.
Critical Impact
Authenticated attackers can coerce the ZenTao server into sending crafted HTTP requests to internal or external endpoints, enabling reconnaissance of internal networks and interaction with otherwise unreachable services.
Affected Products
- ZenTao versions up to and including 21.7.6-85642
- Component: Webhook Module (module/webhook/model.php)
- Vulnerable function: fetchHook
Discovery Timeline
- 2026-02-04 - CVE-2026-1884 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-1884
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery [CWE-918]. The fetchHook function in module/webhook/model.php processes webhook configuration data and initiates outbound HTTP requests based on user-supplied URLs. The function does not adequately validate or restrict destination addresses before issuing the request.
An attacker with sufficient privileges can configure a webhook pointing to internal network resources, cloud metadata endpoints, or other restricted services. The ZenTao server then performs the request on behalf of the attacker, returning or exposing the result. This bypasses network perimeter controls that would normally block direct access to internal infrastructure.
The attack is remotely initiated over the network and requires no user interaction. Exploitation requires high-privilege authentication, which limits the population of viable attackers but does not eliminate the risk in environments with shared administrative access.
Root Cause
The root cause is missing validation of webhook destination URLs in the fetchHook function. The code accepts arbitrary scheme, host, and path values without enforcing an allowlist or blocking requests to private address space (RFC 1918), loopback addresses, link-local ranges, or cloud metadata services such as 169.254.169.254.
Attack Vector
An authenticated attacker with administrative privileges creates or modifies a webhook configuration in ZenTao, supplying a URL pointing to a sensitive internal resource. When the webhook is triggered, the ZenTao server submits the HTTP request to the attacker-chosen target. The attacker observes response data or side effects to map internal services, retrieve metadata credentials, or interact with internal APIs.
The vulnerability manifests in the webhook request dispatch logic. Refer to the GitHub Issue Discussion and VulDB entry #344264 for technical details on the disclosed proof of concept.
Detection Methods for CVE-2026-1884
Indicators of Compromise
- Outbound HTTP requests from the ZenTao server to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254
- Webhook configurations referencing non-standard ports, internal hostnames, or non-HTTP schemes
- Unexpected entries in the ZenTao webhook configuration table created or modified by administrative accounts
Detection Strategies
- Inspect ZenTao webhook configurations for URLs targeting private network ranges or sensitive internal services
- Review web server and application logs for outbound requests originating from fetchHook execution paths
- Correlate administrative login activity with webhook creation or modification events to identify suspicious sequences
Monitoring Recommendations
- Forward ZenTao application logs and outbound proxy logs to a centralized logging platform for analysis
- Alert on outbound connections from the ZenTao application server to RFC 1918 addresses or cloud metadata IPs
- Track changes to webhook configurations through database audit logging or file integrity monitoring on module/webhook/
How to Mitigate CVE-2026-1884
Immediate Actions Required
- Restrict administrative access to ZenTao to a minimal set of trusted users and enforce strong authentication
- Audit existing webhook configurations and remove any pointing to internal, loopback, or metadata endpoints
- Place the ZenTao server behind an egress proxy that blocks requests to private IP ranges and cloud metadata services
Patch Information
At the time of publication, the vendor has not released a fix and did not respond to disclosure attempts. Monitor the ZenTao project channels and VulDB record #344264 for updates. Apply vendor patches immediately once they become available.
Workarounds
- Configure network-level egress filtering to deny ZenTao server connections to internal subnets and 169.254.169.254
- Disable the Webhook Module if it is not required for business operations
- Implement a reverse proxy or web application firewall rule that rejects webhook configuration submissions containing internal host references
# Example iptables egress restriction for the ZenTao host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
