CVE-2026-34719
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Zammad, a web-based open source helpdesk/customer support system, prior to versions 7.0.1 and 6.5.4, had a vulnerability in the webhook model that lacked proper validation for loopback or link-local addresses. Only the URL scheme (HTTP/HTTPS) and hostname were checked, potentially leading to disclosure of confidential cloud/hosting metadata. The fix extends validation both when configuring webhooks and triggering webhook jobs.
Risk Assessment
The risk involves disclosure of confidential cloud environment metadata, such as configuration data, which could be used for further attacks.
Recommendation
Update Zammad to version 7.0.1 or 6.5.4, which fix this vulnerability.
Original NVD description (English source)
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.