Improper Validation in Zammad's Webhook Model Exposes Sensitive Metadata
CVE-2026-34719

8.3HIGH

Key Information:

Vendor

Zammad

Status
Zammad
Vendor
CVE Published:
8 April 2026

What is CVE-2026-34719?

The Zammad Helpdesk application, prior to versions 7.0.1 and 6.5.4, was susceptible to security flaws due to inadequate validation of loopback and link-local addresses in its webhook configuration. The existing system only validated the URL scheme (HTTP/HTTPS) and hostname, allowing attackers to potentially retrieve sensitive metadata from cloud or hosting services through unauthorized webhooks. The recent update strengthens the validation process, ensuring that both webhook configuration and triggered jobs meet robust security checks.

Affected Version(s)

zammad < 6.5.4 < 6.5.4

zammad >= 7.0.0-alpha, < 7.0.1 < 7.0.0-alpha, 7.0.1

References

https://github.com/zammad/zammad/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.