CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
Unauthenticated attackers behind a same-host proxy can bypass authentication to read sensitive profiler data including secrets and configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109325?
CVE-2026-109325 is a high-severity authentication bypass vulnerability in getgrav grav, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
Weakness: CWE-200
Which versions are affected by CVE-2026-109325?
How do I fix CVE-2026-109325?
No fix has been published for CVE-2026-109325 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-109325 being exploited?
There is no known exploitation of CVE-2026-109325 in the wild and no public exploit code.
Sources
Also known as GHSA-pm6p-v8qr-5mmg, GHSA-v8fx-pc9p-934x.