Security readout for executives and security teams
Plain-English summary
Wekan’s outgoing webhook checks could accept a DNS hostname that resolves to a normally blocked internal address. This creates a server-side request forgery risk for Wekan 8.36 through 9.73. The reported IPv4 destination was already blocked during delivery, but inconsistent validation left broader bypass and maintenance risk. Wekan 9.74 fixes the issue.
Executive priority
Treat this as a high-priority upgrade, particularly where users can configure integrations and Wekan reaches internal systems. Although active exploitation is not evidenced, the potential confidentiality impact is high and the fix is available. Confirm deployment coverage and inspect existing webhook destinations promptly.
Technical view
The Integration URL validator compared only the literal hostname against regular expressions. DNS-resolving hostnames could therefore pass initial validation. Connection-time protection used separate IPv4-only resolution and a duplicated blocklist. Version 9.74 centralizes IP blocking, validates every resolved IPv4 and IPv6 address, pins the connection, and blocks redirects.
Likely exposure
Exposure is limited to Wekan versions 8.36 through 9.73 where a user can configure outgoing webhook Integration URLs. Risk is greatest where the Wekan server can reach sensitive internal services or network metadata endpoints. The supplied sources do not establish that every accepted hostname results in a successful internal request.
Exploitation context
The CVSS vector indicates network reachability, low attack complexity, required low privileges, no user interaction, and potentially high confidentiality impact. The supplied record is not in KEV and provides no evidence of active exploitation. It describes a bypass pattern and an incomplete fix of CVE-2026-53446.
Researcher notes
This is CWE-918 and an incomplete fix of CVE-2026-53446. The central issue is validation inconsistency: literal-hostname filtering at input time versus separate IPv4-only resolution at connection time. The 9.74 change resolves all addresses, applies shared blocking logic, pins connections, and disables redirects, reducing DNS rebinding, IPv6, and policy-drift risk.
Mitigation direction
- Upgrade Wekan to version 9.74 or later.
- Prioritize internet-facing deployments and servers with access to sensitive internal networks.
- Review and remove untrusted outgoing webhook Integration URLs.
- Consult the Wekan security advisory if an immediate upgrade is impossible.
Validation and detection
- Confirm every Wekan deployment reports version 9.74 or later.
- Inventory outgoing webhook integrations and identify DNS-based destination hostnames.
- Verify the deployed code uses the shared SSRF guard introduced by the referenced fix.
- Confirm resolved IPv4 and IPv6 destinations are validated and redirects are blocked.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-68558 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N3.14.7GitHub_MVulnerability scoring details
Base CVSS 3.1 score
8.5HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wekan/wekan/security/advisories/GHSA-66m2-4wfr-c45pCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/wekan/wekan/commit/ef845fe4a0adb82af436313310939cd48c0b1347CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/wekan/wekan/releases/tag/v9.74CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.