EUVD-2026-22298
GHSA-fpx9-9hq8-w2xc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.
AnalysisAI
Server-Side Request Forgery in Webkul Krayin CRM 2.2.x enables authenticated users to scan internal network resources and access sensitive information through the webhook creation endpoint. Attackers with low-privilege accounts can send crafted POST requests to /settings/webhooks/create, forcing the server to make requests to arbitrary internal URLs. With CVSS 8.5 (High) and scope change to other components, this allows reconnaissance of internal infrastructure, access to cloud metadata endpoints, and potential lateral movement. EPSS data not available; no public exploit identified at time of analysis, though technical details are published in security advisory.
Technical ContextAI
Krayin CRM is a Laravel-based customer relationship management platform developed by Webkul. The vulnerability exists in the webhook creation functionality at /settings/webhooks/create, which fails to properly validate or sanitize URL inputs before making server-side HTTP requests. Server-Side Request Forgery (SSRF) vulnerabilities occur when an application accepts user-controlled URLs and makes requests without adequate validation, allowing attackers to abuse the server as a proxy. In this case, the webhook configuration feature-designed to send notifications to external services-can be manipulated to target internal network addresses (RFC 1918 private ranges, localhost, link-local addresses) or cloud metadata endpoints (169.254.169.254 for AWS/Azure/GCP). The scope change (S:C) in the CVSS vector indicates the vulnerability affects resources beyond the vulnerable component's security scope, meaning attackers can reach separate internal systems or services that trust requests from the CRM server.
RemediationAI
Organizations running Krayin CRM 2.2.x should immediately review the security advisory at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38527 for vendor guidance and patch availability. No vendor-released patch version is independently confirmed from available data at time of analysis. As interim mitigation, implement network-level controls to restrict outbound connections from the CRM server to only necessary external webhook destinations using allowlist-based firewall rules. Block access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254). Implement application-level input validation to reject webhook URLs containing private IP addresses, localhost references, or cloud metadata endpoints. Restrict webhook creation functionality to highly trusted administrative users only, reducing the PR:L attack surface. Monitor the official Krayin GitHub repository at https://github.com/krayin/laravel-crm for security patches and upgrade immediately when available.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today