CVE-2026-91970: Vikunja Planka Migrator DOS Vulnerability

CVE-2026-91970 Overview

CVE-2026-91970 is a resource exhaustion vulnerability in Vikunja, an open-source task management platform. Versions before 2.6.0 fail to enforce aggregate memory budgets during Planka migration jobs. Authenticated attackers can submit a migration request that points to an attacker-controlled server. The malicious server advertises numerous size-compliant attachments that, in aggregate, exhaust worker memory. The vulnerability is tracked as CWE-770: Allocation of Resources Without Limits or Throttling and causes denial of service for all users of the affected Vikunja instance.

Critical Impact
An authenticated attacker can crash Vikunja workers by triggering a Planka migration against a hostile server, resulting in denial of service for the entire user base.

Affected Products

Vikunja versions prior to 2.6.0
Vikunja instances with the Planka migrator enabled
Self-hosted Vikunja deployments accepting authenticated migration requests

Discovery Timeline

2026-09-15 - CVE-2026-91970 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91970

Vulnerability Analysis

The vulnerability resides in Vikunja's Planka migrator, a component that imports boards and attachments from a Planka source into Vikunja. During migration, the worker fetches attachments referenced by the source server and buffers them in memory. Each individual attachment complies with per-file size limits, so no single object triggers a rejection. However, the migrator does not track the cumulative memory consumed across the entire migration job.

An authenticated user can register a migration pointing to a server the attacker controls. That server responds with a manifest advertising a large number of size-compliant attachments. The Vikunja worker attempts to allocate memory for each attachment in aggregate, eventually consuming all available memory on the host. Because the migrator runs in the same process space as the rest of the Vikunja backend, memory pressure impacts all concurrent users and requests, not only the attacker's session.

Root Cause

The root cause is missing enforcement of an aggregate memory budget in the migration pipeline. The Planka migrator validates each attachment against per-item constraints but omits a global ceiling on total in-flight data. This is a classic instance of CWE-770, where per-request quotas exist without an overall throttling mechanism.

Attack Vector

Exploitation requires low-privilege authenticated access to the Vikunja instance and network reachability from the Vikunja worker to an attacker-controlled HTTP endpoint. The attacker points the Planka migrator at their hostile server, which advertises many small but numerous attachments. The migrator downloads and buffers them until worker memory is exhausted, producing an out-of-memory condition. See the GitHub Security Advisory GHSA-wq92-8x3r-fm38 and the VulnCheck Advisory for additional detail.

Detection Methods for CVE-2026-91970

Indicators of Compromise

Vikunja worker processes terminating with out-of-memory errors or being killed by the OS OOM killer
Outbound HTTP requests from Vikunja workers to unfamiliar or externally hosted domains during Planka migration jobs
Migration job records referencing external servers not controlled by the organization
Sudden spikes in Vikunja process memory usage correlated with authenticated migration API calls

Detection Strategies

Audit Vikunja application logs for Planka migration invocations and record the source URL, initiating user, and job duration
Alert on Vikunja worker memory consumption exceeding a defined baseline threshold
Correlate authenticated migration requests with subsequent worker restarts or crashes
Monitor for repeated migration attempts from the same account within short time windows

Monitoring Recommendations

Collect host-level memory telemetry for systems running Vikunja and forward it to a central analytics pipeline
Log all Planka migration API calls with user identity, timestamp, and target server
Configure alerting on Vikunja process exits with signal SIGKILL or exit code indicating OOM
Track outbound network connections from Vikunja workers and flag connections to non-approved destinations

How to Mitigate CVE-2026-91970

Immediate Actions Required

Upgrade Vikunja to version 2.6.0 or later on all self-hosted instances
Restrict which users are permitted to initiate migration jobs, limiting the feature to trusted administrators
Review recent migration job history for suspicious external source URLs
Enforce egress filtering from Vikunja workers to prevent connections to arbitrary internet hosts

Patch Information

The Vikunja maintainers addressed the issue in version 2.6.0. The fix enforces an aggregate memory budget across all attachments processed during a single Planka migration job. Refer to the GitHub Security Advisory GHSA-wq92-8x3r-fm38 for the official remediation guidance.

Workarounds

Disable the Planka migrator until the upgrade to 2.6.0 is completed
Apply operating system memory limits, such as systemdMemoryMax or container --memory constraints, to bound worker processes
Place Vikunja workers behind an egress proxy that restricts outbound connections to an allowlist of known Planka hosts
Rate-limit authenticated calls to migration API endpoints at the reverse proxy layer

bash

# Example systemd unit override to cap Vikunja memory usage
# /etc/systemd/system/vikunja.service.d/memory.conf
[Service]
MemoryMax=1G
MemoryHigh=768M
TasksMax=256