CVE-2026-27127

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27127
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27127.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27127
Aliases
Downstream
Related
Published
2026-02-24T02:39:44.569Z
Modified
2026-08-07T11:50:15.863674610Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Details

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the <VolumeName> volume and creating assets in the <VolumeName> volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27127.json",
    "cwe_ids": [
        "CWE-367"
    ]
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
19ff89bd870bab917e4d196bc943daac6a3fdb47
Fixed
1a8db788c8b3de85c3aed09ac34046e230079481
Introduced
856f45f2766b1a1df5db437b5cd3fe5cce896b5b
Fixed
daf0ed01c7d2c194ba4a405290e43934d020eef2
Introduced
c6671af5af9e45f57ca9ab50d4b30b07282819d3
Fixed
a4cf3fb63bba3249cf1e2882b18a2d29e77a8575
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:3.5.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.5.1"
        },
        {
            "fixed": "4.16.19"
        },
        {
            "introduced": "5.0.1"
        },
        {
            "fixed": "5.8.23"
        },
        {
            "introduced": "3.5.0-NA"
        },
        {
            "last_affected": "3.5.0-NA"
        },
        {
            "introduced": "5.0.0-NA"
        },
        {
            "last_affected": "5.0.0-NA"
        },
        {
            "introduced": "5.0.0-rc1"
        },
        {
            "last_affected": "5.0.0-rc1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/nystudio107/craft-seomatic
Events
Introduced
c3242251ca85006e2a5b6dfc4654875512b1466e
Last affected
c3242251ca85006e2a5b6dfc4654875512b1466e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:craftcms:craft_cms:3.5.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.5.0-NA"
        },
        {
            "last_affected": "3.5.0-NA"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*
3.5.0
3.5.0-NA
5.*
5.0.0-NA
5.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27127.json"