{"id":"CVE-2026-112288","kind":"vulnerability","aliases":["CVE-2026-112288"],"related":[],"title":"Krayin CRM: webhook SSRF filter bypassed via DNS rebinding to internal hosts","description":"Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.","summary":"Krayin CRM versions from 2.2.5 before 2.2.7 let a user with webhook permissions send requests to internal addresses by using DNS rebinding against the endpoint check. An attacker can reach internal services and cloud metadata endpoints, but the requests are blind, so responses are not returned.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["krayin-crm","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Krayin CRM version in composer.lock or the admin footer; `2.2.5` and `2.2.6` are affected.\n- Check which roles hold webhook permissions in the admin role settings.","fix":"- Upgrade Krayin CRM to `2.2.7` or later.\n- Until then, restrict webhook permissions to trusted administrators.","status":"open","published_at":"2026-10-19T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:46:09+00:00","updated_at":"2026-10-25T04:46:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:46:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Krayin CRM to `2.2.7` or later.\n- Until then, restrict webhook permissions to trusted administrators.","reach":"network","title":"Krayin CRM: webhook SSRF filter bypassed via DNS rebinding to internal hosts","impact":"medium","summary":"Krayin CRM versions from 2.2.5 before 2.2.7 let a user with webhook permissions send requests to internal addresses by using DNS rebinding against the endpoint check. An attacker can reach internal services and cloud metadata endpoints, but the requests are blind, so responses are not returned.","category":"package","nicknames":[],"who_cares":["krayin-crm","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reaches internal services and cloud metadata endpoints blindly","analyst_note":"Confirm the affected version range and whether any fixed version beyond 2.2.7 exists; the NVD entry is the only source.","how_to_check":"- Check the installed Krayin CRM version in composer.lock or the admin footer; `2.2.5` and `2.2.6` are affected.\n- Check which roles hold webhook permissions in the admin role settings.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Self-hosted Krayin CRM installs in the affected range where some users hold webhook permissions. Installs where only trusted administrators can create webhooks have a much smaller exposure, and the sources do not say whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3357,"output_tokens":570,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112288':15A,18A '-2026':14A,17A '2.2.5':31B,75C '2.2.7':33B,77C 'address':44B,96C,105C,113C 'allow':88C 'attack':54B,100C 'blind':67B,120C 'bypass':6A,86C 'check':52B 'cloud':60B,126C 'contain':78C 'crm':2A,21B,28B,74C 'cve':13A,16A 'dns':8A,47B,98C 'endpoint':51B,62B,128C 'filter':5A,85C 'forgeri':84C 'guzzl':115C 'host':12A,26B 'intern':11A,43B,57B,95C,112C,123C 'issafeendpoint':108C 'krayin':1A,20B,27B,73C 'krayin-crm':19B 'let':34B 'metadata':61B,127C 'packag':22B 'permiss':39B,92C 'php':23B 'public':104C 're':117C 're-resolv':116C 'reach':56B,94C 'rebind':9A,48B,99C 'request':41B,65B,83C,121C 'resolv':118C 'respons':69B 'return':72B,102C 'self':25B 'self-host':24B 'send':40B,119C 'server':81C 'server-sid':80C 'servic':58B,124C 'side':82C 'ssrf':4A 'use':46B 'user':36B,89C 'valid':109C 'version':29B 'via':7A,97C 'webhook':3A,38B,91C 'webhookservic':107C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Krayin CRM installs in the affected range where some users hold webhook permissions. Installs where only trusted administrators can create webhooks have a much smaller exposure, and the sources do not say whether managed hosting is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112288","severity":null,"published_at":"2026-10-19T14:17:07+00:00","modified_at":"2026-10-22T03:16:37+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}