Is CVE-2026-38527 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38527 being exploited in the wild.

How severe is CVE-2026-38527?

High severity, with a CVSS score of 8.5, published 14 April 2026.

Which products and versions are affected?

krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.

Is there a fix for CVE-2026-38527?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38527 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38527?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38527: Webkul Krayin CRM SSRF in Webhook Creation

Q: Is there a fix for CVE-2026-38527?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-38527 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-38527?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38527 · Severity: high · CVSS 8.5 · Published 2026-04-14

Webkul Krayin CRM, an open-source customer relationship management platform, contains a vulnerability in its webhook automation feature. An authenticated user can trick the CRM server into making unauthorized requests to internal systems that are not normally accessible from the internet. This could allow an attacker to scan the internal corporate network, access sensitive cloud metadata (such as AWS/GCP credentials), or interact with internal databases, potentially leading to a broader breach of the organization's infrastructure.

Technologies: krayin/laravel-crm (Packagist), Webkul Krayin CRM. Vendors: Packagist, Webkul.

Quick answers

Is CVE-2026-38527 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38527 being exploited in the wild.
How severe is CVE-2026-38527?: High severity, with a CVSS score of 8.5, published 14 April 2026.
Which products and versions are affected?: krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.
Is there a fix for CVE-2026-38527?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38527 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38527?: Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Webkul Krayin CRM v2.2.x within the '/settings/webhooks/create' component. The application fails to validate or restrict the 'end_point' parameter in the WebhookService.php and WebhookRequest.php files, allowing it to accept internal IP addresses and non-routable ranges (RFC 1918, loopback, and cloud metadata endpoints like 169.254.169.254). An authenticated attacker with low privileges can create a crafted webhook and trigger its execution to perform internal port scanning or retrieve sensitive data from internal APIs and cloud instance metadata services. As of the advisory date, no official patch has been confirmed, though mitigations include implementing URL allowlists and blocking private IP ranges at the application or network level.

Affected products

Webkul Krayin CRM (laravel-crm) <= 2.2.0

Identifiers

CVE-2026-38527
GHSA-fpx9-9hq8-w2xc

Timeline

2026-04-14: disclosed: NVD and GitHub Advisory published
2026-04-16: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.