---
id: "CVE-2026-112288"
kind: "vulnerability"
aliases: ["CVE-2026-112288"]
title: "Krayin CRM: webhook SSRF filter bypassed via DNS rebinding to internal hosts"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["krayin-crm", "package", "php", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T14:17:07+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:46:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112288", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Krayin CRM: webhook SSRF filter bypassed via DNS rebinding to internal hosts

Krayin CRM versions from 2.2.5 before 2.2.7 let a user with webhook permissions send requests to internal addresses by using DNS rebinding against the endpoint check. An attacker can reach internal services and cloud metadata endpoints, but the requests are blind, so responses are not returned.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Krayin CRM version in composer.lock or the admin footer; `2.2.5` and `2.2.6` are affected.
- Check which roles hold webhook permissions in the admin role settings.

## Fix

- Upgrade Krayin CRM to `2.2.7` or later.
- Until then, restrict webhook permissions to trusted administrators.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112288

## From the sources

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_