PT-2026-21609 · Pixel & Tonic · Craft Cms

Mhe4Am · Published 2026-01-05 · Updated 2026-02-24 · CVE-2026-27127

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.5.0-RC1 through 4.16.18 Craft CMS versions 5.0.0-RC1 through 5.8.22

Description Craft CMS is susceptible to a Server-Side Request Forgery (SSRF) vulnerability in its GraphQL Asset mutation. The validation process performs DNS resolution separately from the HTTP request, creating a Time-of-Check-Time-of-Use (TOCTOU) condition. This allows attackers to exploit DNS rebinding, where their DNS server returns different IP addresses during validation and the actual request. This bypasses a previous security fix and enables access to blocked IPs, including those used for cloud metadata services like AWS, GCP, Azure, Alibaba Cloud, and Oracle Cloud. Exploitation requires GraphQL schema permissions for editing and creating assets within a specific volume. An attacker could potentially retrieve credentials and achieve code execution by creating new instances with their SSH key. The vulnerability allows access to internal services via DNS rebinding to 127.0.0.1 or 10.x.x.x IP addresses.

Recommendations Craft CMS versions prior to 4.16.19: Implement DNS pinning using CURLOPT RESOLVE to ensure the same IP address is used for both validation and the request. Craft CMS versions prior to 5.8.23: Implement DNS pinning using CURLOPT RESOLVE to ensure the same IP address is used for both validation and the request. As an alternative mitigation, use the resolved IP address directly in the URL and include the original hostname in the Host header. Consider implementing IMDSv2, which requires a token header for accessing instance metadata. Implement network egress filtering to block access to metadata IPs.

Exploit

Fix

Time Of Check To Time Of Use

SSRF

Weakness Enumeration

CWE-367

CWE-918

Related Identifiers

CVE-2026-27127

GHSA-GP2F-7WCM-5FHX

GHSA-X27P-WFQW-HFCC

Affected Products

Craft Cms

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27127.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc · Vendor Advisory
• https://github.com/craftcms/cms/security/advisories/GHSA-gp2f-7wcm-5fhx · Vendor Advisory
• https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27127 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68437 · Security Note
• https://osv.dev/vulnerability/GHSA-gp2f-7wcm-5fhx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x27p-wfqw-hfcc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27127 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52 · Note
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 · Note
• https://github.com/nccgroup/singularity · Note
• https://github.com/taviso/rbndr · Note
• https://github.com/mogwailabs/DNSrebinder · Note