Security readout for executives and security teams
Plain-English summary
Craft CMS has a server-side request forgery protection bypass in certain 4.x and 5.x versions. An attacker with specific GraphQL asset permissions could make the server reach normally blocked internal or cloud metadata addresses using DNS rebinding. This may expose sensitive internal services or credentials. Patched versions are available.
Executive priority
Prioritize patching internet-facing Craft CMS sites and any site with GraphQL enabled for content workflows. The business concern is potential access to internal services or cloud metadata from the CMS server, but exploitation requires specific permissions and conditions.
Technical view
The GraphQL Asset mutation performs DNS resolution during validation separately from the later HTTP request, creating a TOCTOU flaw. DNS rebinding can return a safe address for validation and a blocked address for the request. This bypasses the CVE-2025-68437 fix and affects Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22.
Likely exposure
Exposure is limited to affected Craft CMS deployments where GraphQL schema permissions allow editing and creating assets in a volume. Risk increases if the Public Schema is misconfigured with write permissions. The issue is not marked as CISA KEV in the provided sources.
Exploitation context
Sources describe network exploitation requiring low privileges and specific GraphQL asset permissions. Attack complexity is high and requires a DNS rebinding condition. No provided source states active exploitation in the wild.
Researcher notes
This is a TOCTOU DNS rebinding bypass of SSRF validation in GraphQL Asset mutation handling. The advisory states it broadens the prior bypass beyond IPv6 endpoints to all blocked IPs. Validate exposure by permissions and version, not by version alone.
Mitigation direction
- Upgrade Craft CMS 4.x to 4.16.19 or later.
- Upgrade Craft CMS 5.x to 5.8.23 or later.
- Review GraphQL schemas for asset create and edit permissions.
- Remove write permissions from Public Schema unless explicitly required.
- Check Craft CMS vendor advisory for any additional guidance.
Validation and detection
- Inventory Craft CMS versions across production and staging.
- Confirm no instance runs below 4.16.19 or 5.8.23 in affected branches.
- Review GraphQL schemas for asset mutation write permissions.
- Check whether Public Schema permits asset creation or editing.
- Confirm patch deployment through release records or application version display.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27127 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7HighVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/craftcms/cms/security/advisories/GHSA-gp2f-7wcm-5fhxCVE reference · x_refsource_CONFIRM
- https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfccCVE reference · x_refsource_MISC
- https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.