CVE-2026-15732 WGDashboard CVE debrief

Who should care

WGDashboard users and administrators, security teams, and organizations using WGDashboard should be aware of this critical vulnerability and take immediate action to mitigate the risk. This includes reviewing and restricting webhook functionality, monitoring for suspicious HTTP requests, and implementing compensating controls to detect and prevent SSRF attacks.

Technical summary

A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses, potentially leading to sensitive information disclosure or further attacks. This vulnerability has a CVSS score of 9.8 and a severity of CRITICAL. The vulnerability can be exploited by authenticated attackers to make arbitrary HTTP requests and retrieve responses, which can lead to sensitive information disclosure or further attacks. Defenders should verify the presence of WGDashboard in their environment, review webhook configurations, and monitor for suspicious activity.

Defensive priority

Authenticated attackers can exploit this critical vulnerability to make arbitrary HTTP requests and retrieve responses, potentially leading to sensitive information disclosure or further attacks.

Recommended defensive actions

• Inventory WGDashboard installations to identify potential targets.
• Restrict webhook functionality to minimize exposure.
• Monitor for suspicious HTTP requests.
• Implement compensating controls to detect and prevent SSRF attacks.
• Apply vendor remediation when available.

Evidence notes

The vulnerability exists in WGDashboard version 4.2.3 and earlier, with a CVSS score of 9.8 and a severity of CRITICAL. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses. Evidence is limited to publicly available information and may not reflect the full scope of affected systems or potential impacts. Defenders should verify the presence of WGDashboard in their environment, review webhook configurations, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.