CVE-2026-56708

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.16

Description An issue in webhook delivery allows for server-side request forgery (SSRF), a technique where an attacker induces a server to make requests to an unintended location. This is achieved through DNS rebinding, where an attacker controls the authoritative DNS for a configured webhook hostname to bypass validation by providing public addresses during validation lookups and private addresses during delivery lookups, enabling access to internal network resources.

Recommendations Update Grav API plugin to version 1.0.16 or later.