CVE-2026-56708 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding
Attackers can bypass webhook hostname validation via DNS rebinding to access internal network resources in the Grav API plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56708?
CVE-2026-56708 is a medium-severity server-side request forgery vulnerability in getgrav grav, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.
Weakness: CWE-367
Which versions are affected by CVE-2026-56708?
How do I fix CVE-2026-56708?
No fix has been published for CVE-2026-56708 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-56708 being exploited?
There is no known exploitation of CVE-2026-56708 in the wild and no public exploit code.
Sources
Also known as GHSA-h2w4-jr6m-7c52.