CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Attackers with webhook permissions can bypass SSRF filters via DNS rebinding to access internal services and cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112288?
CVE-2026-112288 is a low-severity server-side request forgery vulnerability in krayin laravel-crm, published on 19 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
Weakness: CWE-918
Which versions are affected by CVE-2026-112288?
How do I fix CVE-2026-112288?
No fix has been published for CVE-2026-112288 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-112288 being exploited?
There is no known exploitation of CVE-2026-112288 in the wild and no public exploit code.
Sources
Also known as GHSA-xjh5-97m9-9vqf.