CVE-2026-68558

Name of the Vulnerable Software and Affected Versions Wekan versions 8.36 through 9.73

Description The outgoing webhook Integration URL validator in models/integrations.js only checked the literal URL.hostname against regular expressions. This allowed DNS names that resolve to restricted IP addresses to bypass the initial check. While the fetchSafe guard in the delivery path blocked certain IPv4 destinations, the use of a separate IPv4-only resolver and a duplicated blocklist caused inconsistent enforcement across different address families and created a risk of drift between input-time and connection-time validation. This could lead to Server-Side Request Forgery (SSRF), where an attacker induces the server to make requests to an unintended location.

Recommendations Update to version 9.74.