Open Source Kanban System Vulnerability in Wekan by Wekan

CVE-2026-68558

What is CVE-2026-68558?

The Wekan kanban application, built on the Meteor framework, presented a significant input validation error in its webhook integration mechanism. Prior to version 9.74, the URL validator in the integration model inadequately checked hostnames against regular expressions, allowing potentially malicious DNS names like 169-254-169-254.nip.io to bypass initial checks. Although the fetchSafe guard was designed to block such IPv4 addresses, discrepancies between input-time and connection-time evaluations created a risk of inconsistent address handling. The issue has been effectively resolved in version 9.74, which ensures comprehensive address resolution and validation through a more robust mechanism.

References