CVE-2026-56708: Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Q: Which deployments are affected?

Deployments using Grav API Plugin versions earlier than 1.0.16 are affected when webhook delivery is configured for a hostname that an attacker can control through authoritative DNS.

Q: What must an attacker control to exploit this issue?

The attacker must control authoritative DNS for a configured webhook hostname. They can return a public address during hostname validation and a private address during webhook delivery.

Q: What is the practical impact of successful exploitation?

Successful exploitation lets the attacker cause the server to send webhook requests to internal network resources by bypassing hostname validation through DNS rebinding.

Published Aug 25, 2026

Updated

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.

Affected Software

1 affected component

Grav API plugin<1.0.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav API Plugin to a version that resolves this vulnerability.
Fixed in 1.0.16
Compensating control
Ensure the webhook hostname’s DNS is authoritative and cannot be controlled by an attacker to prevent DNS rebinding (e.g., restrict who can modify the authoritative DNS records for the configured webhook hostname).

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using Grav API Plugin versions earlier than 1.0.16 are affected when webhook delivery is configured for a hostname that an attacker can control through authoritative DNS.

What must an attacker control to exploit this issue?

The attacker must control authoritative DNS for a configured webhook hostname. They can return a public address during hostname validation and a private address during webhook delivery.

What is the practical impact of successful exploitation?

Successful exploitation lets the attacker cause the server to send webhook requests to internal network resources by bypassing hostname validation through DNS rebinding.

CVE-2026-56708: Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker control to exploit this issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker control to exploit this issue?

What is the practical impact of successful exploitation?