CVE-2026-27129 — Server-Side Request Forgery in Craft CMS

CWE-918 — Server-Side Request Forgery5 documents5 sources
Severity
5.7MEDIUMNVD
CNA5.0GHSA5.0OSV5.0
EPSS
0.0%
top 98.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Craftcms Craft CMSCraftcms CMS
Timeline
PublishedFeb 24

Description

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQ…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Packagistcraftcms/cms5.0.0-RC1 — 5.8.23+1
▶NVDcraftcms/craft_cms3.5.0 — 4.16.19+2
▶CVEListV5craftcms/cms>= 4.5.0-RC1, < 4.16.19, >= 5.0.0-RC1, < 5.8.23+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution↗2026-02-24
▶
CVEList
Cloud Metadata SSRF Protection Bypass via IPv6 Resolution↗2026-02-24
▶
OSV
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution↗2026-02-24
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27129 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-27129 — Server-Side Request Forgery | cvebase