Read the docs
TI-2026-76488 Aliases CVE-2026-112288GHSA-xjh5-97m9-9vqf

SSRF filter bypass via DNS rebinding in Krayin CRM webhooks

Priority LOW 11CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Krayin CRM from 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass in the webhook feature. A user with webhook permissions can pass the endpoint check by returning a public address during validation and an internal address when Guzzle re-resolves the hostname through DNS rebinding (CWE-918). An attacker with high privileges can send blind requests to internal services and cloud metadata endpoints over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed laravel-crm (krayin): 2.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
krayinlaravel-crm2.2.5 to before 2.2.72.2.7Patch availableCNA
  • laravel-crm Vendorkrayin Affected 2.2.5 to before 2.2.7 Fixed in 2.2.7 Patch available CNA

Remediation

Krayin CRM laravel-crm users should upgrade to version 2.2.7, which is the fixed version listed for this product. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA laravel-crm (krayin) Fixed in 2.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    krayin laravel-crm 2.2.7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-76487 Broken object level authorization in Krayin CRM mail modulePriority LOW 31
    • TI-2026-76486 Insecure direct object reference in Krayin CRM exposes other users' quotesPriority LOW 31
    Show all 3 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112288
  2. 2026-10-19 Alias added: GHSA-xjh5-97m9-9vqf
  3. 2026-10-22 CISA SSVC decision points changed

References

Patch 2

Other 2

  • TI-2026-30041 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup CVSS 4.0CRITICAL 9.3
  • TI-2026-61808 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse CVSS 4.0HIGH 8.8
  • TI-2026-44065 Krayin CRM Insecure Direct Object Reference via Controllers CVSS 4.0HIGH 8.7
  • TI-2026-30042 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter CVSS 4.0HIGH 8.7
  • TI-2026-65023 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization CVSS 4.0MEDIUM 6.9
  • TI-2026-64295 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting CVSS 4.0MEDIUM 5.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences