CVE-2026-109325: Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Q: Which Grav deployments are affected?

Grav versions from 2.0.22 up to, but not including, 2.1.7 are affected.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction, but must be able to reach Grav through an HTTP proxy running on the same host. The bypass relies on the profiler trusting a loopback REMOTE_ADDR value supplied through that proxy path.

Q: What information could be exposed?

An attacker can read Clockwork profiler records. Those records may expose system and plugin configuration, secrets, request metadata, and queries.

Published Oct 12, 2026

Updated

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

Affected Software

1 affected component

Grav Grav>=2.0.22<2.1.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav to a version that resolves this vulnerability.
Fixed in 2.1.7

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Grav deployments are affected?

Grav versions from 2.0.22 up to, but not including, 2.1.7 are affected.

What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction, but must be able to reach Grav through an HTTP proxy running on the same host. The bypass relies on the profiler trusting a loopback REMOTE_ADDR value supplied through that proxy path.

What information could be exposed?

An attacker can read Clockwork profiler records. Those records may expose system and plugin configuration, secrets, request metadata, and queries.

CVE-2026-109325: Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Grav deployments are affected?

What does an attacker need to exploit this issue?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which Grav deployments are affected?

What does an attacker need to exploit this issue?

What information could be exposed?