VulnSocial

CVE-2026-34719Patch(zammad / zammad)

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch zammad zammad systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.

zammad CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • zammad

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-04-08); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
zammad
Products
zammad

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-08: 1Mentions · 2026-04-09: 1Patch / Workaround · 2026-04-08: 1Technical Details · 2026-04-08: 1Technical Details · 2026-04-09: 104-0804-09
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-081
Patch1
2026-04-091
Disclosure1
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-34719 Server-Side Request Forgery in Zammad Webhook Model Prior to 7.0.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34719 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The post notes a Server‑Side Request Forgery (SSRF) vulnerability in Zammad Webhook Model versions older than 7.0, linking to a vulnerability detail page, but provides no PoC, exploit, or mitigation.

    0000041
    4.0K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-34719 Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresse… https://www.cve.org/CVERecord?id=CVE-2026-34719

    Post summary

    CVE-2026-34719 impacts Zammad's webhook validation before versions 7.0.1/6.5.4; the issue is addressed in those releases and no PoC, exploit, or active attack is reported.

    0000088
    57.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appzammadzammad---
Appzammadzammad7.0.0--

Explore more

Back to dashboardzammad CVEszammad vulnerabilities