Authentication Bypass in Grav Clockwork Profiler

Grav CMS versions 2.0.22 through 2.1.6 contain an authentication bypass vulnerability within the Clockwork profiler component. The vulnerability exists due to a logic flaw where the component implicitly trusts loopback addresses found in the REMOTE_ADDR header. Attackers positioned behind a same-host HTTP proxy can manipulate these headers to bypass authentication controls typically enforced on the profiler interface. Successful exploitation allows unauthorized access to sensitive application data, including system and plugin configuration files, sensitive secrets, database queries, and request metadata. This exposure presents a significant risk, as it provides an attacker with reconnaissance data that could facilitate further exploitation of the application or the underlying infrastructure. Organizations running affected versions are urged to upgrade to version 2.1.7 or later to remediate the vulnerability.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive application information, including configuration data, secrets, and internal request metadata. This exposure significantly lowers the barrier for subsequent attacks, potentially leading to full system compromise depending on the nature of the leaked secrets.

Recommendation

• Upgrade Grav CMS to version 2.1.7 or later immediately to patch CVE-2026-109325.
• Audit access logs for unauthorized requests targeting the Clockwork profiler endpoints (e.g., /clockwork/app) that originate from non-loopback IPs but bypass authentication.
• Implement strict header validation at the web server or load balancer level to prevent REMOTE_ADDR header spoofing by untrusted clients.