CVE-2026-56708: Grav API Plugin SSRF Vulnerability

CVE-2026-56708 Overview

CVE-2026-56708 is a Server-Side Request Forgery (SSRF) vulnerability in the Grav API plugin before version 1.0.16. The flaw resides in webhook delivery logic that validates a target hostname separately from the actual HTTP request. Attackers who control the authoritative Domain Name System (DNS) for a configured webhook hostname can exploit this Time-of-Check Time-of-Use (TOCTOU) window using DNS rebinding. The validation lookup returns a public IP address, while the subsequent delivery lookup returns a private address. This allows outbound requests from the Grav server to reach internal network resources that should be unreachable from the internet.

Critical Impact
Attackers can pivot from a public-facing Grav installation to internal services, cloud metadata endpoints, or private HTTP APIs by abusing webhook delivery.

Affected Products

Grav CMS API plugin versions prior to 1.0.16
Grav deployments configured to send outbound webhooks
Any downstream applications relying on the plugin's webhook allow-list

Discovery Timeline

2026-08-25 - CVE-2026-56708 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-56708

Vulnerability Analysis

The Grav API plugin performs hostname validation on webhook targets to prevent requests to internal address space. The validation resolves the hostname and checks the resulting IP address against a block list. The subsequent HTTP client then performs an independent DNS resolution when it delivers the payload. Because the two resolutions are not bound to the same IP, an attacker who controls DNS for the target hostname can rotate answers between calls. This design maps to [CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition].

Root Cause

The root cause is a split between the security check and the resource use. The plugin trusts that a hostname resolved once for validation will resolve to the same address when the HTTP request executes. It does not pin the validated IP address or perform the actual request against the exact address that passed the allow-list check. Short DNS Time-to-Live (TTL) values make this race trivially winnable by the attacker.

Attack Vector

An attacker registers a domain and configures its authoritative DNS to alternate answers with a low TTL. The attacker submits or triggers a webhook configuration pointing at that hostname. The plugin resolves the name and receives a public IP that passes validation. When the plugin then dispatches the webhook, DNS returns a private address such as 127.0.0.1, 169.254.169.254, or an RFC1918 range. The HTTP request is sent from the Grav server to that internal endpoint. See the GitHub Security Advisory GHSA-hq2v-cgw4-fw2w and the VulnCheck advisory for full technical detail.

Detection Methods for CVE-2026-56708

Indicators of Compromise

Outbound HTTP requests from the Grav server to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254.
Webhook configurations pointing to hostnames with anomalously low DNS TTL values.
Repeated DNS queries for the same webhook hostname within a short window returning different address families.
Grav plugin versions prior to 1.0.16 present in installed package inventories.

Detection Strategies

Correlate DNS resolver logs with outbound web request logs from the Grav host to identify rebinding patterns.
Alert on any egress connection from the CMS host destined for internal subnets or cloud metadata IPs.
Inspect webhook target configurations for domains whose authoritative name servers return non-public addresses.

Monitoring Recommendations

Enable outbound network segmentation logging on the Grav server and forward to a central log store.
Monitor DNS query patterns for TTL values below 30 seconds against webhook target domains.
Track process-level network telemetry for the PHP-FPM or web worker process that services Grav.

How to Mitigate CVE-2026-56708

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.16 or later on all installations.
Audit existing webhook configurations and remove entries pointing to untrusted or attacker-controllable hostnames.
Restrict egress from the Grav server so that it cannot reach internal networks or cloud metadata endpoints.

Patch Information

The Grav maintainers fixed the flaw in Grav API plugin 1.0.16. Upgrade instructions and the corrected webhook delivery logic are documented in the GitHub Security Advisory GHSA-hq2v-cgw4-fw2w.

Workarounds

Block the Grav server from initiating connections to RFC1918, loopback, and link-local ranges at the network layer.
Route webhook traffic through an egress proxy that resolves and pins the destination IP once and blocks private ranges.
Disable webhook functionality in the API plugin until the upgrade to 1.0.16 is deployed.

bash

# Example egress restriction using iptables to block private ranges from the web server
iptables -A OUTPUT -o eth0 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -o eth0 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -o eth0 -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -o eth0 -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -o eth0 -d 127.0.0.0/8 -j REJECT