CVE-2026-62668: Grav API Plugin SSRF Vulnerability

CVE-2026-62668 Overview

CVE-2026-62668 is a Server-Side Request Forgery (SSRF) vulnerability in the Grav API Plugin, a RESTful API for Grav CMS that provides headless access to site content. Versions prior to 1.0.6 accept webhook URLs after only FILTER_VALIDATE_URL syntax validation, and initialize cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An authenticated account holding the api.webhooks.write scope can submit file, dict, gopher, private-network, or link-local targets. This flaw is tracked under [CWE-918].

Critical Impact
An attacker with webhook write permission can read local files, pivot to internal services, and exfiltrate cloud instance metadata credentials.

Affected Products

Grav CMS API Plugin versions prior to 1.0.6
WebhookController.php component
WebhookDispatcher.php cURL request handler

Discovery Timeline

2026-08-19 - CVE-2026-62668 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-62668

Vulnerability Analysis

The Grav API Plugin exposes a webhook subsystem that dispatches HTTP callbacks to URLs supplied by API clients. Before version 1.0.6, WebhookController.php validated submitted URLs using only PHP's FILTER_VALIDATE_URL function. This filter confirms syntactic well-formedness but does not restrict schemes, hostnames, or IP address ranges.

When the dispatcher invokes cURL, it omits both CURLOPT_PROTOCOLS and CURLOPT_REDIR_PROTOCOLS. As a result, libcurl honors any scheme it was compiled with, including file://, dict://, gopher://, ftp://, and ldap://. Attackers can retrieve local files and issue crafted byte streams to internal TCP services.

The controller also fails to block reserved address ranges. Requests targeting 127.0.0.1, RFC1918 private networks, or the 169.254.169.254 link-local cloud metadata endpoint are accepted and executed. Response bodies are returned to the caller, enabling data exfiltration.

Root Cause

The root cause is insufficient input validation combined with missing protocol allowlisting in the outbound HTTP client. Syntax-only URL validation permits dangerous schemes and internal targets, while unrestricted cURL protocol handling amplifies the impact by allowing follow-on redirects to non-HTTP schemes.

Attack Vector

An authenticated caller with the api.webhooks.write scope submits a webhook whose target URL points at an internal resource. The dispatcher executes the request server-side and returns the delivery response body. Cloud deployments are particularly exposed because http://169.254.169.254/latest/meta-data/ returns instance credentials on AWS.

php

// Patch excerpt: enforce API key scopes before granting webhook write access
// Source: https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e
$scopes = $request->getAttribute('api_key_scopes');
if (is_array($scopes) && $scopes !== [] && !$this->scopesPermit($scopes, $permission)) {
    throw new ForbiddenException("API key is not authorized for: {$permission}");
}

// Super admin can do anything
if ($this->isSuperAdmin($user)) {
    return;
}

Detection Methods for CVE-2026-62668

Indicators of Compromise

Outbound HTTP requests from the Grav web server process to 169.254.169.254, 127.0.0.1, or RFC1918 addresses.
Webhook records in the Grav API database referencing file://, dict://, gopher://, or ftp:// schemes.
Unexpected api.webhooks.write scope assignments on API keys not owned by administrators.

Detection Strategies

Inspect webhook configuration tables for URLs that fail an allowlist of http:// and https:// schemes bound to expected external hostnames.
Correlate PHP-FPM or Apache egress traffic with webhook creation events to spot anomalous internal destinations.
Alert on cURL user-agent traffic from the Grav host toward cloud metadata IP ranges.

Monitoring Recommendations

Enable egress firewall logging and deny outbound traffic from the Grav host to 169.254.169.254 and internal management subnets.
Audit API key creation and scope changes in Grav admin logs, focusing on api.webhooks.write grants.
Review the GitHub Security Advisory GHSA-58q8-f7v4-w2vf for vendor-supplied detection notes.

How to Mitigate CVE-2026-62668

Immediate Actions Required

Upgrade the Grav API Plugin to version 1.0.6 or later using the GitHub Release 1.0.6 artifacts.
Revoke and reissue any API keys that hold the api.webhooks.write scope to invalidate potentially exposed credentials.
Audit existing webhook records and delete entries with non-HTTP schemes or internal targets.

Patch Information

Version 1.0.6 introduces API key scope enforcement, guards super-admin targets, and restricts webhook URLs. The dispatcher now applies protocol allowlisting and blocks private and link-local address ranges. See the GitHub Commit Update for the full change set.

Workarounds

Restrict outbound network access from the Grav web server to explicit external destinations via host firewall or egress proxy.
Remove the api.webhooks.write scope from all non-administrative API keys until the patch is applied.
Place a reverse proxy in front of Grav that blocks metadata IP ranges and non-HTTP schemes on outbound cURL traffic.

bash

# Example iptables rules to block cloud metadata and loopback egress from the web server
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT