{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-109326/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109325"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (2.0.22-2.1.6)","Grav (\u003c 2.1.7)","nginx (\u003c 2.1.7)","lighttpd (\u003c 2.1.7)","Microsoft","Caddy (\u003c 2.1.7)"],"_cs_severities":["high"],"_cs_tags":["web-application","information-disclosure","cve-2026-109326"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eGrav CMS versions 2.0.22 through 2.1.6 contain an authentication bypass vulnerability within the Clockwork profiler component. The vulnerability exists due to a logic flaw where the component implicitly trusts loopback addresses found in the REMOTE_ADDR header. Attackers positioned behind a same-host HTTP proxy can manipulate these headers to bypass authentication controls typically enforced on the profiler interface. Successful exploitation allows unauthorized access to sensitive application data, including system and plugin configuration files, sensitive secrets, database queries, and request metadata. This exposure presents a significant risk, as it provides an attacker with reconnaissance data that could facilitate further exploitation of the application or the underlying infrastructure. Organizations running affected versions are urged to upgrade to version 2.1.7 or later to remediate the vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive application information, including configuration data, secrets, and internal request metadata. This exposure significantly lowers the barrier for subsequent attacks, potentially leading to full system compromise depending on the nature of the leaked secrets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Grav CMS to version 2.1.7 or later immediately to patch CVE-2026-109325.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized requests targeting the Clockwork profiler endpoints (e.g., /clockwork/app) that originate from non-loopback IPs but bypass authentication.\u003c/li\u003e\n\u003cli\u003eImplement strict header validation at the web server or load balancer level to prevent REMOTE_ADDR header spoofing by untrusted clients.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:35:30Z","date_published":"2026-10-12T18:35:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-auth-bypass/","summary":"Grav versions 2.0.22 through 2.1.6 are vulnerable to an authentication bypass in the Clockwork profiler that trusts loopback REMOTE_ADDR headers, potentially exposing system configuration and secrets.","title":"Authentication Bypass in Grav Clockwork Profiler","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-109326","version":"https://jsonfeed.org/version/1.1"}