Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2026-27127 Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutat… https://www.cve.org/CVERecord?id=CVE-2026-27127
Post summary
The CVE record describes an SSRF vulnerability in Craft CMS’s GraphQL Asset mutation, but provides no PoC, exploit code, active exploitation evidence, or patch information.
CVE-2026-27127: Ghost in the Machine: Weaponizing DNS Rebinding to Bypass SSRF Filters in Craft CMS Craft CMS, a popular choice for developers who like their content managed and their code explicitly typed, recently patched a Server-Side Request Forge... https://cvereports.com/reports/CVE-2026-27127
Post summary
Craft CMS has released a patch for CVE-2026-27127, a DNS rebinding-based SSRF vulnerability that bypasses SSRF filters.
CVE-2026-27127 Server-Side Request Forgery Vulnerability in Craft CMS GraphQL Asset Mutation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27127
Post summary
The text references CVE‑2026‑27127 as a Server‑Side Request Forgery in Craft CMS GraphQL Asset Mutation but provides no further details such as PoC, exploit, patch, or active exploitation.
🚨 HIGH severity: CVE-2026-27127 impacts Craft CMS (4.5.0-RC1 – 4.16.18, 5.0.0-RC1 – 5.8.22). TOCTOU in GraphQL Asset mutation enables DNS rebinding & SSRF. Patch now! 🔒 https://radar.offseq.com/threat/cve-2026-27127-cwe-367-time-of-check-time-of-use-t-5842a733 #OffSeq #CraftCM... https://t.co/si56SSacxD
Post summary
The tweet announces a high‑severity CVE‑2026‑27127 affecting Craft CMS, details a TOCTOU bug that allows DNS rebinding and SSRF, and urges users to apply the available patch.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 3.5.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |