CVE-2026-68901

Executive Summary

CVE-2026-68901 is a denial-of-service (DoS) vulnerability in Wekan, an open-source kanban board application built on the Meteor framework. Affecting all versions prior to 10.38, the vulnerability allows an authenticated attacker to send crafted requests to specific export API endpoints with an invalid authToken query parameter, causing an unhandled TypeError (null pointer dereference) that can terminate the Wekan process and deny service to all users. The issue carries a CVSS score of 6.5 (High availability impact), and while no public exploit or in-the-wild activity has been reported, the attack surface is network-accessible and trivial to exploit once an account is obtained.

Technical Analysis

The vulnerability resides in the export functionality implementation of Wekan, specifically within the models/export.js and models/exportExcel.js source files. Four API endpoints are affected:

1. /api/boards/:boardId/export — standard board export (JSON format)
2. /api/boards/:boardId/attachments/:attachmentId/export — attachment-level export
3. /api/boards/:boardId/export/csv — CSV format export
4. /api/boards/:boardId/exportExcel — Excel format export

The root cause is a NULL pointer dereference (CWE-476) triggered by an improper validation sequence. When a request arrives at any of these endpoints, the handler performs a user lookup using the attacker-controlled authToken query parameter. The code immediately invokes user._id.toString() on the result of ReactiveCache.getUser() without first verifying that the returned value is not undefined.

Under normal circumstances, a valid authToken maps to an authenticated user object. However, when an attacker submits an unknown or expired token, ReactiveCache.getUser() returns undefined. The subsequent access of _id on undefined throws a TypeError — specifically a "Cannot read properties of undefined (reading '_id')" error.

Critically, this exception occurs inside an asynchronous route handler. In the Meteor framework (built on Node.js), unhandled rejections from asynchronous operations can propagate to the process level. Depending on the Node.js configuration (specifically the --unhandled-rejections=throw default mode in newer Node.js versions), an unhandled promise rejection results in the process crashing, thereby terminating the entire Wekan instance.

The vulnerability is particularly problematic because:

• The attacker does not need valid credentials for the target board — any valid account token (even for a different board or a low-privilege user) is sufficient, as the request only needs to reach the export handler.
• The authToken parameter is fully attacker-controlled and requires no special encoding or obfuscation.
• The crash affects the entire process, meaning all users on that Wekan instance lose service simultaneously, not just the attacker or the targeted board.

The fix in version 10.38 addresses the issue in two ways:

1. 401 Guard Addition: After each export token lookup, a guard checks whether the user lookup returned undefined. If so, the handler responds with HTTP 401 Unauthorized instead of proceeding to access properties on the undefined object.

2. safeRoute() Wrapping: All export handlers are wrapped with a safeRoute() utility that catches unexpected exceptions and converts them into controlled HTTP error responses rather than allowing them to propagate as unhandled rejections.

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability. The attack chain below is inferred from the NVD description and the vulnerability class (NULL pointer dereference causing DoS).

Step 1 — Reconnaissance / Target Identification: The attacker first identifies a publicly accessible Wekan instance. Wekan instances are commonly exposed on the internet on ports 80/443 or default Meteor ports (3000). The attacker confirms the software version by examining the login page, API responses, or static resource fingerprints. Instances running version 10.37 or earlier are vulnerable. The attacker also needs a valid account. Registration is often open by default in Wekan deployments, or the attacker may use harvested credentials from prior breaches, or create a test account if self-registration is enabled.

Step 2 — Flaw Class Trigger: The attacker authenticates to obtain a valid session token, then selects any board ID (:boardId) from the instance. Notably, the vulnerability does not require the attacker to have access to the specific board — the exploit relies on the export handler performing a user lookup before any authorization check on the board itself. The attacker crafts an HTTP GET request to one of the four affected endpoints, appending an authToken query parameter that is invalid or unknown (e.g., a random 17-character hex string not matching any active session).

Step 3 — Payload / Execution Method: The attack is a simple HTTP request with no payload body:

GET /api/boards/<any-board-id>/export?authToken=invalidtoken123 HTTP/1.1
Host: target-wekan-instance

Because the handler fetches the user via ReactiveCache.getUser() and immediately calls .toString() on user._id without a null check, the invalid token causes undefined._id access, throwing an uncaught TypeError. Since this occurs within an asynchronous route handler, the exception becomes an unhandled promise rejection.

Step 4 — Post-Exploitation Impact: The unhandled rejection terminates the Node.js process hosting Wekan. All ongoing user sessions are dropped, open WebSocket connections are severed, and the kanban board service becomes unavailable to all users. The impact is a full denial of service. In many deployments, the process may be automatically restarted by process managers (e.g., systemd, PM2, Docker restart policies), but the attacker can repeat the request indefinitely, creating a persistent DoS condition. If no auto-restart mechanism exists, the service remains down until manual intervention by an administrator. Because the attack requires only a valid account (or even just knowledge of any board ID if authentication is somehow bypassed), it can be trivially automated to keep the service in a crash-loop state.

Impact Assessment

Business Impact: High availability impact. A successful exploitation results in complete loss of service for all Wekan users at the target instance. This disrupts project management, task tracking, and team collaboration workflows. For organizations relying on Wekan as their primary project management tool, downtime translates to lost productivity and potential missed deadlines. The attack is low-effort (simple HTTP request) yet high-impact (full service termination).

CVSS Breakdown:

• Attack Vector (AV:N): Network — exploit is remotely deliverable.
• Attack Complexity (AC:L): Low — no special conditions or race windows required.
• Privileges Required (PR:L): Low — a valid account is required (or any means to send an authenticated request with a token).
• User Interaction (UI:N): None — no victim interaction needed.
• Confidentiality/Integrity Impact: None — the vulnerability does not leak or modify data.
• Availability Impact (A:H): High — complete process termination.

Affected Systems: All Wekan deployments running versions prior to 10.38. This includes self-hosted instances across Docker, Kubernetes, bare-metal, and cloud VM deployments.

Blast Radius: Single Wekan instance per exploitation attempt; however, in multi-tenant deployments where one Wekan instance serves multiple organizations, all tenants are affected simultaneously.

CISA KEV Status: Not listed — no known active exploitation in the wild.

Detection Guidance

Sigma Rule

title: Wekan Export Endpoint DoS Attempt - Invalid AuthToken
id: 2f8c4d1e-9a3b-4c7d-8e5f-1a2b3c4d5e6f
status: experimental
description: Detects requests to Wekan export endpoints with an invalid or unknown authToken parameter, indicating a potential NULL pointer dereference DoS attempt (CVE-2026-68901).
logsource:
  category: webserver
  product: wekan
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains:
      - '/api/boards/'
      - '/export'
      - '/export/csv'
      - '/exportExcel'
      - 'authToken='
  filter_valid:
    cs-uri-query|contains:
      - 'authToken=' 
    cs-uri-query|re: 'authToken=[a-f0-9]{17}'  # Valid Meteor session token length
  condition: selection and not filter_valid
  timeframe: 5m
level: medium
falsepositives:
  - Legitimate requests with expired session tokens (indicates normal session timeouts)
  - Automated health checks or monitoring tools that probe endpoints with placeholder tokens
fields:
  - c-ip
  - cs-uri-query
  - sc-status
tags:
  - attack.t1499
  - cve.2026-68901
  - cwe.476

YARA Rule

rule Wekan_Export_DoS_Exploit_CVE_2026_68901 {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects HTTP request patterns targeting Wekan export endpoints with invalid authToken parameters, indicative of CVE-2026-68901 exploitation"
        date = "2026-01-15"
        cve = "CVE-2026-68901"
        severity = "medium"
        reference = "NVD Description - Wekan prior to 10.38"

    strings:
        $export1 = "/api/boards/" ascii nocase
        $export2 = "/export" ascii nocase
        $export3 = "/export/csv" ascii nocase
        $export4 = "/exportExcel" ascii nocase
        $token_param = "authToken=" ascii nocase
        $http_get = "GET" ascii nocase

    condition:
        uint16(0) == 0x0A0D and
        $http_get and
        ($export1 and ($export2 or $export3 or $export4)) and
        $token_param
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET WEB_SERVER Wekan Export Endpoint DoS Attempt (CVE-2026-68901)";
    flow:to_server,established;
    http.method;"GET";
    http.uri;
    content:"/api/boards/";
    content:"/export";
    content:"authToken=";
    http.uri; nocase;
    reference:cve,2026-68901;
    classtype:attempted-dos;
    sid:3317001;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where process.name == "node" and event.action == "process_start"]
  [network where destination.port in (3000, 80, 443) and
   network.direction == "ingress" and
   url.path : "/api/boards/*" and
   url.path : ("*export*", "*exportExcel*") and
   url.query : "authToken=*" and
   not url.query : "authToken=" + "???????"]

Note: For valid Meteor session tokens (17 alphanumeric characters in a specific pattern), adjust the exclusion regex accordingly. EQL may require a match instead of any depending on event types available.

Splunk SPL Query

index=web* sourcetype=access_combined
| where like(uri_path, "/api/boards/%") 
| where (like(uri_path, "%/export%") OR like(uri_path, "%/exportExcel%"))
| where like(uri_query, "authToken=%")
| eval token_length = len(replace(uri_query, "^.*authToken=([^&]+).*$", "\1"))
| eval token_valid = case(match(uri_query, "authToken=[a-zA-Z0-9]{17}"), "valid", match(uri_query, "authToken=[a-zA-Z0-9]{1,16}|authToken=[a-zA-Z0-9]{18,}"), "invalid", 1=1, "unknown")
| where token_valid == "invalid"
| stats count by src_ip, uri_path, status, _time
| sort - _time
| rename src_ip as "Source IP", uri_path as "Target Endpoint", status as "HTTP Status", count as "Request Count"

Wazuh OSSEC Rule

<group name="wekan-dos,">
  <rule id="100531" level="8">
    <decoded>json</decoded>
    <match>GET /api/boards/</match>
    <match>/export</match>
    <match>authToken=</match>
    <regex>authToken=(?!.*[a-zA-Z0-9]{17})</regex>
    <description>Wekan export endpoint queried with suspicious authToken - possible CVE-2026-68901 DoS attempt</description>
    <group>attack.t1499,cwe.476,cve.2026-68901,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED per tracked sources. Despite the vendor's fix in version 10.38 per the NVD description, no patch evidence was observed from any tracked source at the time of this report. Treat this as unpatched and assume all instances running older versions remain vulnerable.

1) Immediate Mitigations (Compensating Controls):

• Upgrade to Wekan 10.38 or later as the primary remediation. Version 10.38 adds the 401 guard and safeRoute() wrapping to all export handlers.
• Restrict network access to the Wekan admin/API endpoints using a Web Application Firewall (WAF) or reverse proxy. Filter requests to /api/boards/*/export* URLs that contain an authToken parameter of unexpected length or character set.
• Disable self-registration on Wekan if it is enabled, reducing the ability for attackers to obtain valid accounts.
• Implement IP-based rate limiting on API endpoints, particularly for unauthenticated or failed-authentication requests.
• Configure process auto-restart (systemd Restart=always, Docker --restart=always, PM2 --max-restarts with a low retry limit) to minimize downtime if the process is crashed.
• Monitor for repeated crash events and correlate with export endpoint requests.

2) Patch/Upgrade Steps:

1. Back up your Wekan database and configuration files.
2. Consult Wekan release documentation for upgrade path from your current version to 10.38.
3. For Docker deployments: pull the updated container image (wekan/wekan:10.38 or newer) and recreate the container with existing volumes.
4. For source-based deployments: pull the latest code from the official repository and run meteor update or follow the project's upgrade instructions.
5. Verify the upgrade by checking the version banner and re-testing export endpoints with invalid tokens — they should return HTTP 401 rather than crashing the process.

3) Long-Term Hardening:

• Input validation: Treat all query parameters as untrusted input; validate data types before property access.
• Defense in depth: Implement a process supervisor (systemd, supervisor) with automatic restart and health check probes.
• Monitoring: Deploy synthetic monitoring that periodically tests export endpoints with invalid tokens to confirm crash-resistant behavior.
• Patch management: Subscribe to Wekan release notifications and apply security patches within 48 hours.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-68901
2. Wekan Project / GitHub Repository: https://github.com/wekan/wekan — reference for version 10.38 fix notes and release announcement
3. NVD CWE-476 Reference: https://cwe.mitre.org/data/definitions/476.html — NULL Pointer Dereference class
4. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing at the time of this report. EPSS scoring has not been published by FIRST.org. Exploitation is considered unlikely in the immediate term given the lack of public PoC, but the low exploitation complexity and network-accessible attack surface warrant proactive patching and monitoring.