Published: October 19, 2026 | Last Modified: October 19, 2026
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.