Wekan up to 9.73 URL Validator models/integrations.js server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in Wekan up to 9.73. This affects an unknown part of the file models/integrations.js of the component URL Validator. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-68558. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Wekan up to 9.73. This issue affects some unknown processing of the file models/integrations.js of the component URL Validator. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery path's fetchSafe guard already blocked the reported IPv4 destination, but its separate IPv4-only resolver and duplicated blocklist created inconsistent all-address-family enforcement and drift risk between input-time and connection-time validation. Version 9.74 makes server/lib/ssrfGuard.js resolve all addresses with `dns.lookup({ all: true })`, validate every result through the shared isIpBlocked logic, pin the connection, and block redirects. This issue is fixed in version 9.74.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-68558 since 07/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 9.74 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Wekan

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16
• 9.17
• 9.18
• 9.19
• 9.20
• 9.21
• 9.22
• 9.23
• 9.24
• 9.25
• 9.26
• 9.27
• 9.28
• 9.29
• 9.30
• 9.31
• 9.32
• 9.33
• 9.34
• 9.35
• 9.36
• 9.37
• 9.38
• 9.39
• 9.40
• 9.41
• 9.42
• 9.43
• 9.44
• 9.45
• 9.46
• 9.47
• 9.48
• 9.49
• 9.50
• 9.51
• 9.52
• 9.53
• 9.54
• 9.55
• 9.56
• 9.57
• 9.58
• 9.59
• 9.60
• 9.61
• 9.62
• 9.63
• 9.64
• 9.65
• 9.66
• 9.67
• 9.68
• 9.69
• 9.70
• 9.71
• 9.72
• 9.73

Website

• Product: https://github.com/wekan/wekan/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion