Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112288Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding

Low 3.3

In plain English

A low-severity server-side request forgery in laravel-crm from krayin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.

Affected products (as reported)

Vendor	Product	Versions
krayin	laravel-crm	2.2.5 – before 2.2.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/krayin/laravel-crm/pull/2683 patch, issue-tracking
https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28 patch
https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php technical-description
Krayin CRM v2.2.7 Release Notes release-notes
VulnCheck Advisory: Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding third-party-advisory