Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-56708Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Medium 5.3

In plain English

A medium-severity security flaw in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 1.0.16

Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-hq2v-cgw4-fw2w) vendor-advisory
VulnCheck Advisory: Grav API Plugin before 1.0.16 SSRF via DNS Rebinding third-party-advisory