CVE-2026-30844: Wekan Kanban Tool SSRF Vulnerability

CVE-2026-30844 Overview

CVE-2026-30844 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting Wekan, an open source kanban tool built with Meteor. The vulnerability exists in the board import functionality where attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or filtering. This affects both the Wekan and Trello import flows, allowing authenticated attackers to force the server to make arbitrary HTTP requests to internal network resources.

Critical Impact

Authenticated users can exploit the SSRF vulnerability to access internal network services including cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network.

Affected Products

• Wekan version 8.32
• Wekan version 8.33
• Wekan_project Wekan (versions prior to 8.34)

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-30844 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30844

Vulnerability Analysis

This SSRF vulnerability stems from insufficient input validation in Wekan's board import functionality. When users import boards (either in Wekan or Trello format), the application processes JSON data containing attachment URLs. The parseActivities() and parseActions() methods extract these user-controlled attachment URLs and pass them directly to Attachments.load() for download without any sanitization or validation.

The vulnerability allows any authenticated user to craft malicious import files containing URLs pointing to internal network resources. When the server processes the import, it makes HTTP requests to these URLs on behalf of the attacker, effectively bypassing network segmentation and firewall controls. This can lead to exposure of sensitive data from cloud metadata services (such as AWS EC2 instance metadata at 169.254.169.254), internal APIs, databases, and administrative interfaces.

Root Cause

The root cause is the lack of URL validation before server-side HTTP requests are made. The Attachments.load() function accepts arbitrary URLs from user input without checking whether the destination is an internal, private, or otherwise restricted network address. This missing validation allows attackers to specify URLs targeting internal resources that should not be accessible from the public internet.

Attack Vector

The attack vector is network-based and requires low privilege (authentication). An authenticated user can exploit this vulnerability by:

1. Creating a malicious board export JSON file containing crafted attachment URLs pointing to internal services
2. Using Wekan's board import functionality to upload the malicious file
3. The server fetches the specified URLs, making requests to internal network resources
4. Response data or timing information can be used to enumerate internal services or extract sensitive data

// Security patch implementing URL validation (Source: GitHub commit)
+import { Meteor } from 'meteor/meteor';
+
+let dnsModule;
+let netModule;
+let lookupSync;
+
+if (Meteor.isServer) {
+  dnsModule = require('dns');
+  netModule = require('net');
+  lookupSync = Meteor.wrapAsync(dnsModule.lookup);
+}
+
+const BLOCKED_HOSTNAMES = new Set([
+  'localhost',
+  'localhost.localdomain',
+  'ip6-localhost',
+  'ip6-loopback',
+  '0',
+  '0.0.0.0',
+]);
+
+const IPV4_RANGES = [
+  ['0.0.0.0', '0.255.255.255'],
+  ['10.0.0.0', '10.255.255.255'],
+  ['100.64.0.0', '100.127.255.255'],
+  ['127.0.0.0', '127.255.255.255'],
+  ['169.254.0.0', '169.254.255.255'],
+  ['172.16.0.0', '172.31.255.255'],
+  ['192.0.0.0', '192.0.0.255'],
+  ['192.0.2.0', '192.0.2.255'],

Source: GitHub Wekan Commit Update

Detection Methods for CVE-2026-30844

Indicators of Compromise

• Unusual outbound HTTP requests from the Wekan server to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• Server requests to cloud metadata endpoints such as 169.254.169.254
• Board import activity followed by network connections to unexpected internal hosts
• Log entries showing attachment downloads from non-public URLs

Detection Strategies

• Monitor Wekan server network traffic for connections to private IP address ranges and localhost
• Implement network-level logging to capture outbound requests from the Wekan application server
• Alert on any requests to cloud provider metadata endpoints (169.254.169.254 for AWS/Azure/GCP)
• Review board import logs for suspicious attachment URLs containing internal hostnames or IP addresses

Monitoring Recommendations

• Deploy network segmentation to limit Wekan server access to internal resources
• Implement egress filtering to restrict outbound connections from the Wekan server
• Set up alerts for unusual patterns of outbound HTTP requests following board import operations
• Monitor for access to sensitive internal services that should not receive requests from the Wekan application

How to Mitigate CVE-2026-30844

Immediate Actions Required

• Upgrade Wekan to version 8.34 or later immediately
• Review recent board import logs for any suspicious activity
• Audit network logs for potential SSRF exploitation attempts against internal resources
• Rotate any credentials that may have been exposed through cloud metadata services

Patch Information

The vulnerability has been fixed in Wekan version 8.34. The patch introduces a new attachmentUrlValidation.js module that validates attachment URLs before making server-side requests. The fix blocks requests to localhost, private IP ranges, and cloud metadata endpoints. Users should upgrade to version 8.34 or later using the official release available at GitHub Wekan Release v8.34.

For detailed technical information about the vulnerability and fix, see the GitHub Security Advisory GHSL-2026-045.

Workarounds

• Implement network-level egress filtering to prevent the Wekan server from accessing internal network resources
• Deploy a web application firewall (WAF) to inspect and block suspicious board import requests
• Restrict board import functionality to trusted administrators only until the patch can be applied
• Use network segmentation to isolate the Wekan server from sensitive internal services

# Configuration example - Network egress filtering using iptables
# Block Wekan server from accessing internal network ranges
iptables -A OUTPUT -m owner --uid-owner wekan -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 169.254.169.254 -j DROP