CVE-2026-27127
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS's GraphQL Asset mutation that allows DNS rebinding attacks. Attackers can bypass IP restrictions by manipulating DNS responses between validation and actual request phases. Affected systems include Craft CMS versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers with GraphQL permissions can access internal network resources, potentially leading to data exfiltration, internal service enumeration, or further network compromise.
Likely Case
Authenticated users with asset editing permissions can bypass IP restrictions to access blocked internal endpoints, potentially exposing sensitive internal services.
If Mitigated
With proper GraphQL permission controls and network segmentation, impact is limited to accessing only authorized internal resources.
🎯 Exploit Status
Exploitation requires authenticated access with specific GraphQL permissions and control over DNS responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.19 and 5.8.23
Vendor Advisory: https://github.com/craftcms/cms/security/advisories/GHSA-gp2f-7wcm-5fhx
Restart Required: No
Instructions:
1. Update Craft CMS to version 4.16.19 or 5.8.23. 2. Verify the update completed successfully. 3. Test GraphQL asset functionality.
🔧 Temporary Workarounds
Restrict GraphQL Permissions
allLimit GraphQL schema access and remove write permissions from Public Schema if not needed.
Network Segmentation
allImplement network controls to restrict outbound HTTP requests from CMS servers.
🧯 If You Can't Patch
- Review and restrict GraphQL permissions to minimum required
- Implement network egress filtering and monitor for unusual outbound requests
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via composer show craftcms/cmsCheck Version:
composer show craftcms/cms | grep versionVerify Fix Applied:
Confirm version is 4.16.19+ or 5.8.23+ and test GraphQL asset mutations with restricted IPs📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL asset mutation requests
- Requests to internal IP addresses from CMS
Network Indicators:
- Outbound HTTP requests to internal IP ranges from CMS server
- DNS queries followed by HTTP requests to different IPs
SIEM Query:
source="craft-cms" AND ("GraphQL" OR "asset mutation") AND ("internal" OR "192.168" OR "10." OR "172.16")