← Vulnerability feed

Vulnerability record · CVE-2026-30844 · published 6 March 2026

CVE-2026-30844: Wekan project wekan server-side request forgery (ssrf) vulnerability

WWekan Project · Wekan

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or filtering, affecting both the Wekan and Trello import flows. The parseActivities() and parseActions() methods extract user-controlled attachment URLs, which are then passed directly to Attachments.load() for download with no sanitization. This Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to make the server issue arbitrary HTTP requests, potentially accessing internal network services such as cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network. This issue has been fixed in version 8.34.

9.3 CVSS 4.0 Critical EPSS 0.42% · top 66.5% CWE-918 · Server-side request forgery (SSRF)
9.3CVSS 4.0 base score
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or filtering, affecting both the Wekan and Trello import flows. The parseActivities() and parseActions() methods extract user-controlled attachment URLs, which are then passed directly to Attachments.load() for download with no sanitization. This Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to make the server issue arbitrary HTTP requests, potentially accessing internal network services such as cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network. This issue has been fixed in version 8.34.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wekan/wekan/commit/62216e36c15f55d4ef6cb97313db3aa54fc77fe0 Patch
https://github.com/wekan/wekan/releases/tag/v8.34 Release Notes
https://securitylab.github.com/advisories/GHSL-2026-045_Wekan/ Third Party Advisory

Track CVE-2026-30844 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-30847Wekan project wekan information exposure vulnerabilityWekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user doc…EPSS 0.41%9.3CVE-2026-30843Wekan project wekan insecure direct object reference vulnerabilityWekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which cou…EPSS 0.38%8.8CVE-2025-65780Wekan project wekan improper access control vulnerabilityAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire…EPSS 0.34%8.7CVE-2026-30846Wekan project wekan information exposure vulnerabilityWekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook int…EPSS 0.60%8.7CVE-2026-25560Wekan project wekan ldap injection vulnerabilityWeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into…EPSS 0.89%8.2CVE-2025-65781Wekan project wekan improper authentication vulnerabilityAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorizat…EPSS 0.34%8.1CVE-2025-65778Wekan project wekan cross-site scripting vulnerabilityAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with att…EPSS 0.38%8.1CVE-2021-3309Wekan project wekan improper certificate validation vulnerabilitypackages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority tr…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2026-30844), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.