CVE-2026-56708: Grav API Plugin before 1.0.16 SSRF via DNS Rebinding
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.16 - Compensating control
Ensure the webhook hostname’s DNS is authoritative and cannot be controlled by an attacker to prevent DNS rebinding (e.g., restrict who can modify the authoritative DNS records for the configured webhook hostname).
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Grav API Plugin versions earlier than 1.0.16 are affected when webhook delivery is configured for a hostname that an attacker can control through authoritative DNS.
What must an attacker control to exploit this issue?
The attacker must control authoritative DNS for a configured webhook hostname. They can return a public address during hostname validation and a private address during webhook delivery.
What is the practical impact of successful exploitation?
Successful exploitation lets the attacker cause the server to send webhook requests to internal network resources by bypassing hostname validation through DNS rebinding.