CVE-2026-34719CWE-918

Zammad has a Server-side request forgery (SSRF) via webhooks

High · published April 8, 2026

CVSS v4.0
8.3
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:H
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-08T18:02Z
EPSS history
Timeline
  • 08 APR 18:02Z
    Zammad has a Server-side request forgery (SSRF) via webhooks
    cvelistv5