Krayin CRM EUVD-2026-104285

Exploitation requires an authenticated Krayin CRM account that holds webhook permissions (PR:H) - it is not available to anonymous or ordinary users. The attacker must control a DNS name that alternates responses so that WebhookService::isSafeEndpoint() sees a public address while Guzzle re-resolves to an internal address, meaning success is gated on winning a time-of-check/time-of-use DNS-rebinding race (AC:H, AT:P). The resulting SSRF is blind (no response is returned to the attacker), which limits data exfiltration to what can be inferred or what internal services act on. Affected versions are 2.2.5 through 2.2.6; upgrading to 2.2.7 closes the bypass by pinning the connection to the validated address.

This is a low-priority vulnerability by almost every available signal. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N) yields a base score of only 2.1, and the individual metrics explain why: although the attack vector is network-reachable (AV:N), exploitation requires high privileges (PR:H - an account holding webhook permissions), high attack complexity (AC:H), and a present attack requirement (AT:P) corresponding to winning the DNS-rebinding race between validation and re-resolution. The impact is capped at low confidentiality and low integrity (VC:L/VI:L) with no availability impact and no subsequent-system (scope) impact. There is no CISA KEV listing, no EPSS score provided, and no public exploit code referenced in the inputs - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent rather than conflicting: a privileged, high-complexity, race-condition-dependent SSRF that yields only blind requests is genuinely low real-world risk. The main caveat is that blind SSRF to cloud metadata endpoints (e.g., 169.254.169.254) can, in specific cloud deployments, lead to credential theft that the CVSS 'low' impact scoring understates - defenders in cloud environments should weight this slightly higher than the 2.1 score alone suggests.

An authenticated Krayin CRM user who has been granted webhook permissions creates a webhook pointing at an attacker-controlled hostname. The attacker's DNS server returns a public IP during WebhookService::isSafeEndpoint() validation but an internal IP when Guzzle re-resolves the name to send the request, bypassing the SSRF filter and firing blind requests at internal services or the cloud metadata endpoint. No public proof-of-concept exploit is referenced in the provided data, and the attack depends on reliably winning the DNS-rebinding race (AC:H/AT:P).