CVE-2026-41129 craftcms CVE debrief

Who should care

Defenders managing Craft CMS instances, especially those with exposed GraphQL schemas or enabled permissions for asset editing and creation, should assess exposure and prioritize patching.

Why it matters

CVE-2026-41129 is a Server-Side Request Forgery vulnerability in Craft CMS that requires specific GraphQL schema permissions. Defenders managing Craft CMS instances should assess exposure and prioritize patching to prevent potential unauthorized requests, data breaches, or system compromise.

• Potential unauthorized requests to internal resources
• Possible data breaches or system compromise
• Need for verification of instance exposure and patching
• Potential impact on system availability or integrity

Technical summary

CVE-2026-41129 is a Server-Side Request Forgery vulnerability in Craft CMS versions 4.x through 4.17.8 and 5.x through 5.9.14. The vulnerability requires specific GraphQL schema permissions: 'Edit assets in the <VolumeName> volume' and 'Create assets in the <VolumeName> volume.' Patched versions are 4.17.9 and 5.9.15. Defenders should prioritize patching vulnerable Craft CMS instances, especially those with exposed GraphQL schemas or enabled permissions for asset editing and creation, to prevent potential unauthorized requests or system compromise.

Defensive priority

Defenders should prioritize patching vulnerable Craft CMS instances, especially those with exposed GraphQL schemas or enabled permissions for asset editing and creation.

Recommended defensive actions

• Patch Craft CMS instances to versions 4.17.9 or 5.9.15
• Review and limit GraphQL schema permissions for asset editing and creation
• Monitor for potential exploitation attempts
• Verify instance exposure and review configurations
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and patched versions. However, additional information on potential exploitation or impact is limited. Defenders should verify instance exposure, review GraphQL schema permissions, and monitor for potential exploitation attempts. The lack of detailed information on exploitation or impact requires a cautious approach, focusing on patching and limiting potential attack surfaces.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.