{"id":"CVE-2026-27127","published":"2026-02-24T02:39:44Z","modified":"2026-02-28T02:12:36Z","title":"Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00487,"percentile":0.41838,"provenance":"source"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-gp2f-7wcm-5fhx","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575","tags":["x_refsource_MISC"]}],"priority":{"score":13.3,"factors":[{"name":"EPSS percentile","points":8.37},{"name":"CVSS severity","points":4.9}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.5.0-RC1, < 4.16.19",">= 5.0.0-RC1, < 5.8.23"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=5.0.0-RC1, <5.8.23",">=3.5.0, <4.16.19"],"patched":["5.8.23","4.16.19"],"from":["GHSA-gp2f-7wcm-5fhx"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-7402","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2025-68437","parents":[{"from":"CVE-2025-68437","to":"CVE-2026-27127","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints.","from":"CVE.org","in":"CVE-2026-27127"},{"kind":"osv-related","provenance":"source","id":"GHSA-x27p-wfqw-hfcc","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-gp2f-7wcm-5fhx","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc"}]}]}}