CVE-2026-15732
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
Risk Assessment
The risk for the organization includes the possibility of using the server as a proxy to attack internal network resources, which could lead to disclosure of sensitive information or further compromise.
Recommendation
It is recommended to immediately update WGDashboard to the latest version that does not contain this vulnerability, and restrict access to the webhook functionality to trusted users only.
Other vulnerabilities in WGDashboard
See all- CVE-2026-15734Critical
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier allows authenticated attackers to execute arbitrary code as root.
- CVE-2026-15733Critical
A Remote Code Execution (RCE) vulnerability exists in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
- CVE-2026-44343Critical
WGDashboard, a dashboard for managing WireGuard VPN, prior to version 4.3.2 had critical vulnerabilities that could allow unauthorized parties to access the host file system without authentication.
Original NVD description (English source)
A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.