CVE-2026-109325: Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.1.7
Event History
Frequently Asked Questions
Which Grav deployments are affected?
Grav versions from 2.0.22 up to, but not including, 2.1.7 are affected.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction, but must be able to reach Grav through an HTTP proxy running on the same host. The bypass relies on the profiler trusting a loopback REMOTE_ADDR value supplied through that proxy path.
What information could be exposed?
An attacker can read Clockwork profiler records. Those records may expose system and plugin configuration, secrets, request metadata, and queries.