Grav API Plugin CVE-2026-56708

Exploitation requires two simultaneous conditions to hold. First, the Grav API plugin must have at least one webhook configured to a hostname for which the attacker holds authoritative DNS control - passive or unauthenticated network attackers cannot exploit this without first influencing webhook configuration or registering a domain that an administrator has already targeted. Second, the attacker must execute a DNS rebinding attack by initially resolving the hostname to a permitted public IP during Grav's validation phase, then switching the DNS response to an RFC1918 or otherwise restricted address before the actual HTTP delivery occurs, requiring TTL manipulation and precise timing. Exploitation is not constrained by system-level authentication on the Grav server (PR:N in the CVSS 4.0 vector), but the social or operational prerequisite of controlling DNS for an administrator-configured webhook endpoint is a meaningful real-world barrier absent in simpler SSRF classes.

The CVSS 4.0 base score of 6.9 (Medium) reflects network-reachable SSRF with no direct impact on the Grav server itself (VC/VI/VA all N) and only limited impact on subsequently reachable internal systems (SC:L/SI:L/SA:L). The attack requires the adversary to hold authoritative DNS control over a hostname that a Grav administrator has already configured as a webhook endpoint - a meaningful precondition that substantially narrows the realistic attacker population compared to what an AC:L/PR:N surface area might suggest. EPSS data was not provided in the intelligence sources, and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread active exploitation. The CVSS 4.0 vector rates AC:L and AT:N, which this analysis considers optimistic given the TTL-timing and DNS-rebinding infrastructure an attacker must operate; a reasonable independent assessment raises complexity to AC:H. KEV absence and the social-engineering prerequisite (influencing webhook configuration) mean even a mid-sized municipal IT team in opole - wait, removing this: no such insertion will be made - the practical blast radius is constrained to deployments where an attacker can plausibly influence both DNS and webhook configuration simultaneously.

An attacker registers a domain (e.g., attacker.example.com) and persuades or tricks a Grav administrator into configuring a webhook delivery to that hostname. The attacker sets the domain's DNS TTL to one second and initially responds to Grav's validation lookup with a legitimate public IP. Immediately before the actual delivery HTTP request, the attacker flips the DNS record to an internal address such as 192.168.1.254, causing Grav to send the webhook payload to an internal service. No public exploit has been identified at time of analysis, though DNS rebinding toolkits are freely available and lower the technical barrier for this class of attack.