CVE-2026-41455

High

Description

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.

SeverityHigh

CVSS8.5

Exploit probability—

ProductWekan

PublishedApr 22, 2026

First seenApr 22, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

wekan wekan8.35.0 or later

Patches

github.com/wekan/wekan/commit/2cd702f48df2b8aef0e7381685f8e089986a18a4

Vendor advisories

github.com/wekan/wekan/releases/tag/v8.35

Affected products

Product	Affected versions	Fixed in
wekan wekan	v < 8.35.0	8.35.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.