{"id":"CVE-2026-27129","published":"2026-02-24T02:45:45Z","modified":"2026-02-28T02:17:18Z","title":"Cloud Metadata SSRF Protection Bypass via IPv6 Resolution","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.7,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00464,"percentile":0.4011,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-v2gc-rm6g-wrw9","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/commit/2825388b4f32fb1c9bd709027a1a1fd192d709a3","tags":["x_refsource_MISC"]}],"priority":{"score":12.0,"factors":[{"name":"EPSS percentile","points":8.02},{"name":"CVSS severity","points":3.99}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.5.0-RC1, < 4.16.19",">= 5.0.0-RC1, < 5.8.23"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=5.0.0-RC1, <5.8.23",">=3.5.0, <4.16.19"],"patched":["5.8.23","4.16.19"],"from":["GHSA-v2gc-rm6g-wrw9"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-7400","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2025-68437","parents":[{"from":"CVE-2025-68437","to":"CVE-2026-27129","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a bypass of the security fix for CVE-2025-68437.","from":"CVE.org","in":"CVE-2026-27129"},{"kind":"osv-related","provenance":"source","id":"GHSA-x27p-wfqw-hfcc","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-v2gc-rm6g-wrw9","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc"}]}]}}