CVE-2026-112288CWE-918ssrf

CVE-2026-112288

Low · published October 19, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00218 · 11.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-19T18:17Z
References (5)
https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php · [email protected]https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28 · [email protected]https://github.com/krayin/laravel-crm/pull/2683 · [email protected]https://github.com/krayin/laravel-crm/releases/tag/v2.2.7 · [email protected]https://www.vulncheck.com/advisories/krayin-crm-2.2.5-before-2.2.7-ssrf-filter-bypass-via-dns-rebinding · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 13:55Z
    Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
    cvelistv5
  • 19 OCT 13:55Z
    Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
    cvelistv5