Live › vulnerability › CVE-2026-112288
Go to dashboardKrayin CRM versions from 2.2.5 before 2.2.7 let a user with webhook permissions send requests to internal addresses by using DNS rebinding against the endpoint check. An attacker can reach internal services and cloud metadata endpoints, but the requests are blind, so responses are not returned.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Krayin CRM installs in the affected range where some users hold webhook permissions. Installs where only trusted administrators can create webhooks have a much smaller exposure, and the sources do not say whether managed hosting is affected.
No product ranges from the sources yet.
2.2.5 and 2.2.6 are affected.2.2.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
This page as .md · .json · in your agent: get_signal("CVE-2026-112288")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.