CVE-2026-109325 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, especially those with profiler enabled, should assess exposure and prioritize patching or mitigation efforts. This includes reviewing profiler configurations, applying patches or mitigations as available, and monitoring for unusual activity in profiler records. Security teams and vulnerability management teams should also be aware of the potential impacts and take proactive measures to protect Grav deployments.

Why it matters

CVE-2026-109325 is a high-severity authentication bypass vulnerability in Grav's Clockwork profiler. Defenders should prioritize verifying exposure, especially for installations with profiler enabled, and apply patches or mitigations as available. The vulnerability allows unauthenticated attackers behind a same-host HTTP proxy to access profiler records, potentially exposing sensitive information. While exploitation and victim information are not available, defenders should take proactive measures to protect Grav installations.

• Potential exposure of system and plugin configuration.
• Potential exposure of secrets and sensitive information.
• Possible unauthorized access to request metadata and queries.
• Need for verification of Grav installations and profiler configurations.

Technical summary

The vulnerability exists in Grav's Clockwork profiler, which trusts loopback REMOTE_ADDR values. This allows unauthenticated attackers behind a same-host HTTP proxy to read profiler records, potentially exposing sensitive information such as system and plugin configuration, secrets, request metadata, and queries. The vulnerability emphasizes the need for defenders to prioritize verifying exposure of Grav installations to this vulnerability, especially those with profiler enabled, and apply patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying exposure of Grav installations to this vulnerability, especially those with profiler enabled, and apply patches or mitigations as available.

Recommended defensive actions

• Verify Grav installations for exposure to CVE-2026-109325, especially those with profiler enabled.
• Apply patches or mitigations as available.
• Monitor for unusual activity in profiler records.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, additional information on exploitation or victim organizations is not available. Defenders should verify Grav installations for exposure, review profiler configurations, and apply patches or mitigations as available. The lack of exploitation or victim information suggests a proactive approach is necessary to protect Grav installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.