CVE-2026-112288: Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Krayin CRMto a version that resolves this vulnerability.Fixed in 2.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permissions to configure or use webhooks in Krayin CRM and must be able to control a DNS name whose resolution can change between validation and the outbound request.
Are default installations affected?
The issue affects Krayin CRM versions from 2.2.5 before 2.2.7 when a user has webhook permissions. Exploitation also depends on DNS rebinding conditions, so it is not reachable by an unauthenticated user without those permissions.
What could an attacker reach?
Successful exploitation can cause blind server-side requests to internal addresses, including internal services and cloud metadata endpoints. The provided information indicates potential confidentiality and integrity impact, but no availability impact.
What can be done before updating?
Restrict webhook permissions to trusted administrators and prevent webhook destinations from using attacker-controlled or rebinding-capable DNS names. Network egress controls that block access to internal address ranges and cloud metadata endpoints can reduce exposure.
How can I determine whether my deployment is affected?
Check whether the deployment runs Krayin CRM 2.2.5 or 2.2.6 and whether users can configure webhooks. Review webhook targets for hostnames controlled outside your organization or DNS records that could resolve differently over time.