CVE-2026-56708: Grav API plugin server-side request forgery in webhook delivery

CVE-2026-56708 · Severity: medium · CVSS 5.3 · Published 2026-08-25

The Grav API plugin's webhook feature is vulnerable to a server-side request forgery (SSRF) attack that allows attackers to access internal network resources. An attacker with webhook configuration permissions can exploit DNS rebinding to bypass hostname validation checks and cause the server to send requests to private internal addresses, potentially exposing sensitive data from internal systems.

Technologies: Grav API Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-56708 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56708 being exploited in the wild.
How severe is CVE-2026-56708?
Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?
Grav API Plugin before 1.0.16.
Is there a fix for CVE-2026-56708?
A patch was published on 2026-08-10: Fix released in version 1.0.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56708 attacked?
It is attacked over the network.
Am I affected by CVE-2026-56708?
Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in the WebhookDispatcher::httpPost() method. The code validates that a webhook hostname resolves to a public address, but then passes the hostname to cURL for delivery, which performs an independent DNS lookup. An attacker controlling authoritative DNS for the configured hostname can respond with a public address during validation and a private address during delivery, bypassing the SSRF guard. Exploitation requires api.webhooks.write permission and control of authoritative DNS with low TTL, making it probabilistic and requiring multiple attempts. The vulnerability is fixed in version 1.0.16 by resolving the hostname once and pinning the validated addresses to the connection.

Affected products

  • Grav API plugin before 1.0.16

Timeline

  • 2026-08-10: disclosed: GitHub Security Advisory GHSA-hq2v-cgw4-fw2w published
  • 2026-08-10: patched: Fix released in version 1.0.16
  • 2026-08-25: other: CVE-2026-56708 assigned (NVD publication date)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.