CVE-2026-53446: Wekan SSRF Vulnerability

CVE-2026-53446 Overview

CVE-2026-53446 is a Server-Side Request Forgery (SSRF) vulnerability in Wekan, an open source kanban application built with Meteor. Versions prior to 9.32 store webhook integration URLs from user input in models/integrations.js and later fetch them through server/notifications/outgoing.js without applying the validateAttachmentUrl() private-network checks defined in models/lib/attachmentUrlValidation.js. A board administrator can configure webhook URLs that trigger server-side requests to internal services or cloud metadata endpoints. The issue is tracked as [CWE-918] and is fixed in Wekan version 9.32.

Critical Impact
Authenticated board administrators can coerce the Wekan server into issuing HTTP requests to internal network resources, including cloud instance metadata services, potentially exposing sensitive infrastructure data.

Affected Products

Wekan versions prior to 9.32
Self-hosted Wekan deployments using outgoing webhook integrations
Containerized Wekan instances running on cloud infrastructure (AWS, Azure, GCP)

Discovery Timeline

2026-07-15 - CVE-2026-53446 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-53446

Vulnerability Analysis

The vulnerability lies in the disconnect between two Wekan code paths that handle URLs. The codebase already implements a validateAttachmentUrl() helper in models/lib/attachmentUrlValidation.js that rejects requests targeting private, loopback, or link-local network ranges. However, the outgoing webhook integration path did not invoke this validator when storing or dispatching webhook URLs. As a result, a board administrator can register a webhook pointing to an internal-only destination and force the Wekan server to make requests on their behalf.

Root Cause

The root cause is missing SSRF validation on webhook URL persistence and delivery. Webhook URLs supplied through the board integration interface are written to the Integrations collection without host filtering. When Wekan later dispatches notifications via server/notifications/outgoing.js, it fetches the stored URL directly, bypassing the existing private-network guardrail intended to prevent SSRF in attachment handling.

Attack Vector

An attacker with board administrator privileges configures an outgoing webhook whose target URL points to an internal resource. Common targets include http://169.254.169.254/latest/meta-data/ on AWS, http://metadata.google.internal/ on GCP, or internal service endpoints such as http://localhost:9200. When a board event fires, the Wekan server issues the HTTP request from within the trusted network boundary and may return response data or side-effects to the attacker through webhook response handling or observable behavior.

javascript

 import { sendJsonResult } from '/server/apiMiddleware';
 import { ReactiveCache } from '/imports/reactiveCache';
 import Integrations from '/models/integrations';
+import { validateAttachmentUrl } from '/models/lib/attachmentUrlValidation';
 
 Meteor.startup(async () => {
   await Integrations._collection.createIndexAsync({ modifiedAt: -1 });

Source: GitHub Commit 0e5fef6 — the patch imports the existing validateAttachmentUrl helper into the integrations module so webhook URLs are subject to the same private-network checks as attachments.

Detection Methods for CVE-2026-53446

Indicators of Compromise

Outbound HTTP requests from the Wekan server process to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback interfaces.
Requests originating from Wekan to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Newly created or modified entries in the Wekan integrations collection referencing internal hostnames or IP literals.

Detection Strategies

Audit the Wekan integrations MongoDB collection for url fields containing private IP ranges, localhost, or metadata service hostnames.
Inspect reverse proxy and egress firewall logs for outbound connections from the Wekan container to unexpected internal destinations.
Correlate board integration creation events with subsequent outbound HTTP traffic patterns to detect probing behavior.

Monitoring Recommendations

Enable egress filtering on the Wekan host to block traffic to cloud metadata IPs and internal management ranges.
Alert on any successful HTTP response returned from 169.254.169.254 or equivalent metadata endpoints to the Wekan process.
Log all administrative changes to board webhook integrations, including the actor, timestamp, and target URL.

How to Mitigate CVE-2026-53446

Immediate Actions Required

Upgrade Wekan to version 9.32 or later, which introduces validateAttachmentUrl() checks in the integrations module.
Review all existing outgoing webhook integrations across every board and remove any pointing to internal, loopback, or metadata addresses.
Restrict board administrator privileges to trusted users only, as this role is required to exploit the flaw.

Patch Information

The fix is delivered in Wekan 9.32 via commit 0e5fef6. See the Wekan v9.32 release notes and the GHSA-hc3x-hq3m-663q advisory for full details. The patch imports the existing validateAttachmentUrl helper and applies it to webhook URL handling.

Workarounds

Deploy Wekan behind an egress proxy that denies connections to RFC1918 ranges and cloud metadata IP addresses.
Enforce IMDSv2 on AWS deployments to require session tokens for metadata access, mitigating SSRF to the metadata endpoint.
Run Wekan in a network segment with no route to sensitive internal services until the upgrade is applied.

bash

# Example iptables egress rule blocking cloud metadata access from the Wekan container
iptables -A OUTPUT -m owner --uid-owner wekan -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner wekan -d 192.168.0.0/16 -j DROP