Grav: Authorization bypass in Clockwork profiler
Summary
Grav versions 1.7.53.3 up to 1.7.53.6 contain an authorization bypass in the Clockwork profiler endpoint /__clockwork/. Access is granted when a request appears to come from the loopback address, so requests relayed by a same-host reverse proxy are trusted. An unauthenticated remote attacker can read stored profiler records, which may include administrator plaintext passwords and configuration credentials.
Affected
- Grav 1.7.53.3 up to, but not including, 1.7.53.6
- Versions before 1.7.53.3: Unknown.
- Grav 2.x: separate issue CVE-2026-109325, fixed in 2.1.7 or later.
Fixed in
- Grav 1.7.53.6
- Grav 2.1.7 (for the 2.x branch, see CVE-2026-109325)
Workaround
- Unknown. No official workaround is documented.
- Until patched, restrict access to /__clockwork/ at the web server or reverse proxy to trusted internal networks.
- Disable the debugger (system.debugger.enabled: false) if it is not needed.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept exploit found.
- Not listed in CISA KEV according to the sources consulted.
Our recommendation
- Update Grav to 1.7.53.6 or later (or 2.1.7 or later on the 2.x branch).
- Check whether the debugger is enabled and disable it if it is not needed.
- Restrict /__clockwork/ to trusted networks until patching is complete.
- If the debugger was enabled on an exposed site, rotate administrator passwords and all credentials stored in the configuration, as they may have been read before the fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit 4d9fca0 (fix) github.com
- Grav release 1.7.53.6 github.com
- GitHub Security Advisory GHSA-xprx-c7jf-cp6g github.com
- VulnCheck advisory www.vulncheck.com
- Vulners CVE-2026-117604 vulners.com
- OffSeq exposure summary radar.offseq.com
- TheHackerWire CVE-2026-117604 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:56.
Original description (NVD)
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
NVD references (4)
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641
- https://github.com/getgrav/grav/releases/tag/1.7.53.6
- https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g
- https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypa…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.