External risk intelligence

WGDashboard SSRF Vulnerability Allows Arbitrary HTTP Requests

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15732

WGDashboard is a web-based management interface for WireGuard VPNs. Such dashboards are typically deployed as web applications on servers or edge services to allow administrative access, making them commonly reachable via the network or internet in typical deployment scenarios.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A Server-Side Request Forgery vulnerability has been identified in WGDashboard, affecting earlier versions. This flaw could permit attackers to initiate unauthorized HTTP requests, potentially leading to the retrieval of sensitive information. The primary concern is to determine if your organization utilizes the affected technology and to what extent it might be exposed.

Issue: Attackers can trick a system into making unintended network requests.
Why remember: Affects systems managing WireGuard VPN connections.
Executive takeaway: Confirm if affected systems are in use.

Attack Path

How an attacker could exploit the issue

Attackers can leverage this vulnerability by sending specially crafted requests to the webhook functionality, even without authentication. This allows them to trick the dashboard into making arbitrary HTTP requests to external or internal resources. Successful exploitation can lead to attackers accessing sensitive information or interacting with internal systems.

No authentication required for attack.
Webhook functionality is the trigger.
Unrestricted server-side requests.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker to make arbitrary HTTP requests from the WGDashboard server, potentially retrieving sensitive information or interacting with internal services. The webhook functionality, when exploited, could lead to unauthorized access to network resources or external systems.

Server-side request forgery.
Authenticated attackers could send crafted requests.
Internal network access or sensitive data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Server-Side Request Forgery vulnerability in WGDashboard affects web applications that manage WireGuard VPNs. Identifying where WGDashboard is deployed, assessing its external reachability and business criticality, and locating the accountable owner are the crucial first steps. Remediation planning should then be prioritized based on the risk determined from this assessment.

Application owners should prioritize triage.
Verify external reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WGDashboard?

WGDashboard is a web-based interface used to manage WireGuard VPN connections. It acts as a control panel for administrators to configure and monitor VPN tunnels and settings through a graphical dashboard, rather than using command-line tools.

What is the Server-Side Request Forgery vulnerability in CVE-2026-15732?

This is a CWE-918 weakness where the application fails to validate the destination of network requests it makes. Essentially, the software can be manipulated into acting as a proxy, sending unintended HTTP requests to other systems on behalf of an attacker.

How is this SSRF triggered in WGDashboard?

The vulnerability is triggered specifically through the application's webhook functionality. By sending a crafted request to this feature, an attacker can force the server to perform HTTP requests it was not intended to make. Normal administrative actions performed through other, non-webhook parts of the dashboard do not initiate these forged requests.

Is my WGDashboard instance at risk?

According to Halo Surface Signal, risk is higher if your dashboard is reachable via the internet or the network. Because these interfaces are often deployed on edge services for administrative access, they are frequently exposed, increasing the likelihood that an attacker can reach the vulnerable webhook functionality.

What should I do if I run WGDashboard?

Your first step is to locate all instances of WGDashboard within your infrastructure to understand where it is deployed. Once identified, evaluate if these instances are accessible from the network, determine their business criticality, and verify who is responsible for managing them to begin planning your risk-based remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.