CVE-2026-109325 in Grav
Summary
by MITRE • 10/12/2026
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Grav content management system version 2.1.7 introduced critical security enhancements addressing a significant authentication bypass flaw present in earlier releases such as 2.0.22 through the pre-2.1.7 series. This vulnerability specifically targets the Clockwork profiler, a debugging and development tool integrated into the platform to assist developers with performance monitoring and request analysis. The core technical deficiency lies in how the application validates the source of incoming requests when determining access permissions for sensitive profiling data. Specifically, the system relies on trusting loopback remote address values without sufficient verification mechanisms to distinguish between legitimate local administrative traffic and malicious external attempts masquerading as internal connections. This design oversight creates a pathway for unauthenticated attackers who are positioned behind an HTTP proxy that shares the same host infrastructure or network segment to exploit this trust relationship.
From a technical perspective, the vulnerability stems from improper validation of the REMOTE_ADDR environment variable within the PHP execution context. When Grav processes requests directed at the Clockwork profiler endpoints, it checks whether the originating IP address corresponds to localhost or loopback interfaces such as 127.0.0.1 or ::1. If this condition is met, the application grants access to the profiling interface without requiring valid authentication credentials. Attackers can leverage reverse proxy configurations or local network routing techniques to spoof their source IP addresses, making external requests appear as if they originate from localhost. This technique effectively bypasses the intended security controls that restrict profiler access to authenticated administrators only. The flaw is categorized under CWE-287 Improper Authentication because it fails to correctly verify the identity of a user or system attempting to gain access to protected resources.
The operational impact of this vulnerability is severe due to the sensitive nature of the data exposed through the Clockwork interface. Once an attacker successfully bypasses authentication, they can read profiler records that contain comprehensive details about the Grav installation and its ecosystem. This includes detailed system configurations, plugin settings, database query logs, request metadata such as headers and cookies, and potentially stored secrets or API keys used by various plugins. The exposure of these elements provides attackers with a rich attack surface for further exploitation. Knowledge of internal configuration structures allows for targeted attacks against specific components, while access to secret values can lead to full system compromise if those credentials are reused elsewhere. Additionally, the visibility into database queries may reveal schema details that facilitate SQL injection or data exfiltration efforts in subsequent stages of an intrusion campaign.
This vulnerability aligns with several MITRE ATT&CK techniques relevant to web application attacks and reconnaissance phases. The initial access vector corresponds to T1078 Valid Accounts if attackers leverage stolen credentials, but more accurately reflects T1190 Exploit Public-Facing Application when leveraging the proxy spoofing technique. The subsequent data access falls under T1530 Data from Cloud Storage or Local System depending on where profiler logs are persisted, and potentially T1005 Data from Local System for reading configuration files. To mitigate this risk, administrators running Grav versions prior to 2.1.7 should immediately upgrade to the patched version which implements stricter validation of request origins beyond simple IP address checking. For environments that cannot be upgraded instantly, implementing network-level restrictions such as firewall rules or reverse proxy configurations that explicitly block access to profiler endpoints from external networks is recommended. Additionally, disabling the Clockwork profiler in production environments where it is not actively needed reduces the attack surface significantly by removing the vulnerable code path entirely until a permanent fix can be applied through version updates.