Grav CMS: Authentication bypass in Clockwork profiler via same-host proxy

Summary

Grav from 2.0.22 before 2.1.7 contains an authentication bypass in the Clockwork profiler, which trusts loopback REMOTE_ADDR values. Requests from a same-host HTTP proxy appear as loopback, so an unauthenticated attacker can read profiler records. These records can expose system and plugin configuration, secrets, request metadata and database queries. The issue requires Clockwork to be enabled and a reverse proxy on the same host; the default FastCGI setup is not affected.

Affected

• Grav 2.0.22 up to, but not including, 2.1.7 (per CVE record)
• Only installations with Clockwork enabled behind a same-host HTTP proxy
• The GitHub advisory lists different version ranges; verify against the vendor's release notes

Fixed in

• Grav 2.1.7 (unaffected according to the CVE record)
• The vendor notes a backport of the fix in a later release; the version number is unknown.

Workaround

• No official workaround other than upgrading or restricting exposure.
• Unknown: whether disabling Clockwork or the debugger fully removes the exposure.
• After upgrading, set debugger.token as required by the fix and confirm the Clockwork configuration.

Exploitation

• No evidence of exploitation in the wild; no CISA KEV listing found.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof-of-concept found.

Our recommendation

• Inventory all Grav installations and identify versions from 2.0.22 to 2.1.6.
• Upgrade to Grav 2.1.7 or later and confirm the debugger token and Clockwork settings.
• Rotate SMTP credentials, API keys and other secrets on any affected instance that was publicly reachable.
• Review web server access logs for unusual requests to profiler paths.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-v8fx-pc9p-934x github.com
• VulnCheck Advisory: Grav Clockwork Profiler Authentication Bypass via Proxy www.vulncheck.com
• OSV: CVE-2026-109325 osv.dev
• Grav Releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:47.