CVE-2026-56708 in API Plugin
Tóm tắt
Bởi MITRE • 25/08/2026
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.