CVE-2026-41129 Overview
CVE-2026-41129 is a Server-Side Request Forgery (SSRF) vulnerability affecting Craft CMS, a popular content management system. The vulnerability exists in the GraphQL mutation handling for asset uploads, where insufficient validation of URL schemes allows authenticated attackers with specific permissions to make arbitrary server-side HTTP requests. Successful exploitation could enable attackers to access internal services, scan internal networks, or exfiltrate sensitive data from protected resources.
Critical Impact
Authenticated attackers with GraphQL asset permissions can leverage SSRF to access internal network resources, potentially exposing sensitive internal services and data.
Affected Products
- Craft CMS 4.x through 4.17.8
- Craft CMS 5.x through 5.9.14
Discovery Timeline
- 2026-04-22 - CVE-2026-41129 published to NVD
- 2026-04-22 - Last updated in NVD database
Technical Details for CVE-2026-41129
Vulnerability Analysis
This SSRF vulnerability resides in Craft CMS's GraphQL asset mutation resolver. The issue stems from the application accepting user-supplied URLs for asset creation without properly validating the URL scheme before processing the request. While the code included hostname validation, it failed to restrict the URL scheme, allowing attackers to specify arbitrary protocols such as file://, gopher://, or dict:// to interact with internal services or read local files.
The vulnerability requires elevated privileges—specifically, the "Edit assets in the volume" and "Create assets in the volume" permissions must be enabled in the GraphQL schema. This limits the attack surface to authenticated users with administrative-level access to asset management, but in multi-tenant or shared hosting environments, this could still represent a significant risk.
Root Cause
The root cause lies in the Asset.php GraphQL resolver failing to validate the URL scheme before processing external URLs. The code path for handling remote asset URLs relied solely on hostname validation, which was insufficient to prevent SSRF attacks using alternative URL schemes that could bypass network-level controls or access local resources.
Attack Vector
An authenticated attacker with the required GraphQL permissions can craft malicious GraphQL mutations that specify URLs with arbitrary schemes. By using schemes like file:// or internal-only protocols, the attacker can:
- Read local files on the server
- Access internal services not exposed to the public internet
- Scan internal network infrastructure
- Potentially interact with cloud metadata services (e.g., http://169.254.169.254/)
The attack is network-based and requires no user interaction beyond the attacker authenticating with appropriate permissions.
} elseif (!empty($fileInformation['url'])) {
$url = $fileInformation['url'];
+ if (!$this->validateScheme($url)) {
+ throw new UserError("$url contains an invalid scheme.");
+ }
+
if (!$this->validateHostname($url)) {
throw new UserError("$url contains an invalid hostname.");
}
Source: GitHub Commit
The patch introduces a new validateScheme() method that checks the URL scheme before any further processing occurs, ensuring only permitted schemes (typically http:// and https://) are accepted.
Detection Methods for CVE-2026-41129
Indicators of Compromise
- GraphQL mutation requests to asset endpoints containing unusual URL schemes (file://, gopher://, dict://, ftp://)
- Asset creation attempts referencing internal IP addresses (127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x)
- Requests targeting cloud metadata endpoints (169.254.169.254)
- Unexpected outbound connections from the Craft CMS application server to internal services
Detection Strategies
- Monitor GraphQL query logs for createAsset or similar mutations with suspicious URL parameters
- Implement Web Application Firewall (WAF) rules to detect SSRF patterns in request payloads
- Review application logs for UserError exceptions related to hostname or scheme validation failures
- Enable network segmentation monitoring to detect unusual server-initiated connections
Monitoring Recommendations
- Configure alerting on GraphQL endpoints for requests containing non-HTTP URL schemes
- Establish baseline network behavior for the CMS server and alert on deviations
- Monitor for access attempts to internal-only services from the web application tier
- Implement egress filtering and log all outbound connections from the CMS server
How to Mitigate CVE-2026-41129
Immediate Actions Required
- Upgrade Craft CMS 4.x installations to version 4.17.9 or later
- Upgrade Craft CMS 5.x installations to version 5.9.15 or later
- Review GraphQL schema permissions and restrict asset creation capabilities to trusted users only
- Audit logs for any suspicious GraphQL asset mutations that may indicate prior exploitation attempts
Patch Information
Security patches are available through official Craft CMS releases. Version 4.17.9 addresses this vulnerability for the 4.x branch, while version 5.9.15 patches the 5.x branch. The fix introduces scheme validation via a new validateScheme() method in the GraphQL asset resolver. For additional details, refer to the GitHub Security Advisory and the related commit.
Workarounds
- Disable GraphQL asset upload functionality if not required by removing "Edit assets" and "Create assets" permissions from all GraphQL schemas
- Implement network-level egress filtering to restrict outbound connections from the CMS server
- Deploy a reverse proxy or WAF with SSRF detection rules in front of the Craft CMS application
- Use allowlist-based URL validation at the infrastructure level if upgrading is not immediately possible
# Verify Craft CMS version after upgrade
./craft version
# Review GraphQL schema permissions
./craft graphql/list-schemas
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
