Description
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
Published: 2026-10-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass & Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows attackers to bypass authentication by exploiting the Clockwork profiler that incorrectly trusts loopback REMOTE_ADDR. This permits unauthenticated access to profiler records, exposing sensitive data such as system configuration, plugin settings, secrets, and request metadata.

Affected Systems

The flaw affects Grav content‑management systems released before version 2.1.7, specifically those from 2.0.22 onward. Any installation of Grav that has the Clockwork profiler enabled is susceptible; attackers located on the same host via an HTTP proxy can exploit the bug.

Risk and Exploitability

The CVSS score of 8.7 classifies it as high severity. EPSS is not available, suggesting limited available exploitation data, and it is not listed in CISA KEV. The likelihood of exploitation is uncertain, but the flaw permits information disclosure without authentication, and attackers need only be able to use a same‑host HTTP proxy or proxy loopback. Mitigation is urgent to prevent unauthorized data access.

Generated by OpenCVE AI on October 12, 2026 at 18:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Grav to version 2.1.7 or later to apply the vendor patch that fixes loopback trust logic.
  • Disable access to the Clockwork profiler on production servers or restrict it to trusted IP ranges.
  • Reconfigure any proxies or network devices so they do not set REMOTE_ADDR to loopback values for requests reaching the server.

Generated by OpenCVE AI on October 12, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
Title Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
First Time appeared Getgrav
Getgrav grav
Weaknesses CWE-200
CPEs cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
Vendors & Products Getgrav
Getgrav grav
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Getgrav Grav
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:12:51.809Z

Reserved: 2026-10-12T14:15:29.012Z

Link: CVE-2026-109325

cve-icon Vulnrichment

Updated: 2026-10-13T18:12:45.391Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T17:17:27.860

Modified: 2026-10-13T19:18:32.477

Link: CVE-2026-109325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T20:15:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor