CVE-2026-117604 in Grav
Summary
by MITRE • 10/27/2026
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Grav versions prior to 1.7.53.6 represents a critical authorization bypass rooted in flawed network address validation logic within the Debugger component. Specifically, the function isDebuggerRequestAuthorized() relies on checking the REMOTE_ADDR server variable to determine if an incoming request originates from a trusted local source, such as localhost or loopback interfaces like 127.0.0.1 and ::1. This mechanism is designed to restrict access to sensitive debugging tools, including the Clockwork profiler, which aggregates detailed application performance data, database queries, and internal state information. By trusting the REMOTE_ADDR header without sufficient verification against proxy headers or additional context, the system assumes that any request appearing to come from a local address is legitimate and authorized for administrative inspection.
The operational impact of this flaw becomes severe in environments where Grav is deployed behind a reverse proxy, such as Nginx, Apache with mod_proxy, or cloud load balancers. In these architectures, external client requests are forwarded to the backend application server via loopback interfaces. Consequently, the REMOTE_ADDR variable on the server side reflects 127.0.0.1 rather than the actual IP address of the remote attacker. An unauthenticated adversary can exploit this by sending HTTP requests directly to the Grav instance or through a proxy that preserves the original connection characteristics in a way that triggers the loopback fallback logic. This allows the attacker to bypass authentication requirements and access the /__clockwork/ endpoint, which is intended for local development use only.
Accessing the Clockwork profiler provides attackers with extensive visibility into the application's internal workings. The profiler stores records of HTTP requests, database interactions, and configuration states during execution. Crucially, depending on the specific Grav plugins and configurations in place, this data may include plaintext administrator passwords, API keys, database credentials, and other sensitive secrets that were logged for debugging purposes. This exposure constitutes a severe confidentiality breach, enabling further attacks such as credential stuffing, lateral movement within internal networks, or complete compromise of the underlying infrastructure if those credentials are reused elsewhere.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if sensitive data is exposed via logging mechanisms. In terms of offensive security frameworks, it maps to ATT&CK technique T1505.003 Server Software Component: Web Shell or similar diagnostic tools used for reconnaissance and credential harvesting. The failure lies in the assumption that network topology guarantees trustworthiness without explicit validation of proxy headers like X-Forwarded-For or strict IP allowlisting based on known proxy addresses rather than generic loopback ranges.
To mitigate this risk, administrators must upgrade Grav to version 1.7.53.6 or later where the authorization logic has been corrected to properly handle proxied requests. In the interim, it is imperative to ensure that the /__clockwork/ directory and associated debugging endpoints are not exposed to external networks via web server configuration rules. Access should be restricted strictly to localhost using firewall-level controls rather than relying solely on application-layer checks of REMOTE_ADDR. Additionally, organizations should audit their logging configurations to prevent sensitive data such as plaintext passwords from being stored in profiler records or log files, adhering to the principle of least privilege and minimizing the blast radius of any potential information disclosure vulnerabilities.