Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / MetricsBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

MetricsBleed

2026-07-19 meifukun (GitHub) and xet7 (fix)

Privately reported 8 issues reviewed against WeKan v9.95.0.
  • MetricsBleed — the /metrics endpoint (models/server/metrics.js) trusted the client-supplied X-Forwarded-For header UNCONDITIONALLY when checking METRICS_ACCEPTED_IP_ADDRESS, so an unauthenticated requester could send X-Forwarded-For: <whitelisted-ip> and read operational Prometheus metrics (connected/registered user counts, board counts, active board titles). Fixed by trusting XFF only when METRICS_TRUST_PROXY is set (parsed spoof-resistantly from the right); otherwise the real socket peer address is used (CWE-290 Authentication Bypass by Spoofing)
  • Reported privately by meifukun (https://github.com/meifukun)
  • Fixed at upcoming WeKan release
  • More details


Details

MetricsBleed — CWE-290 Authentication Bypass by Spoofing

the /metrics endpoint (models/server/metrics.js) trusted the client-supplied X-Forwarded-For header UNCONDITIONALLY when checking METRICS_ACCEPTED_IP_ADDRESS, so an unauthenticated requester could send X-Forwarded-For: <whitelisted-ip> and read operational Prometheus metrics (connected/registered user counts, board counts, active board titles). Fixed by trusting XFF only when METRICS_TRUST_PROXY is set (parsed spoof-resistantly from the right); otherwise the real socket peer address is used.

Reported privately by meifukun (https://github.com/meifukun), who reviewed 8 issues against WeKan v9.95.0 (commit f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only. Fixed at the upcoming WeKan release.