CVE-2026-109325

Executive Summary

CVE-2026-109325 is an authentication bypass vulnerability in the Grav CMS Clockwork profiler affecting versions 2.0.22 through 2.1.6. The vulnerability allows an unauthenticated attacker positioned behind a same-host HTTP proxy to access profiler records because the application trusts loopback REMOTE_ADDR values. Successful exploitation exposes sensitive system and plugin configuration, secrets, request metadata, and database queries, posing a significant confidentiality risk to affected deployments.

Technical Analysis

The vulnerability resides in Grav's Clockwork profiler integration. Clockwork is a PHP development tool used to inspect performance, logs, and request data; in Grav it is surfaced through a profiler component that captures request metadata, queries, configuration, and secrets. The core flaw is an improper authentication check: the profiler trusts the REMOTE_ADDR server variable and treats requests originating from loopback addresses (e.g., 127.0.0.1, ::1) as inherently trusted, bypassing authentication.

When Grav is deployed behind a same-host HTTP reverse proxy (a common configuration), the proxy connects to the upstream application over the loopback interface. As a result, every request forwarded by the proxy appears to originate from 127.0.0.1, regardless of the true client IP. An unauthenticated, remote attacker can therefore reach the profiler endpoint through the proxy and be misidentified as a trusted local request, gaining access to profiler records without any credentials.

This is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a 7.5 High severity rating: the attack is network-exploitable with low complexity, requires no privileges or user interaction, and results in high confidentiality impact with no impact to integrity or availability.

The attack surface is the profiler-accessible HTTP endpoint exposed by Grav. The vulnerability class is an authentication bypass via trust of a spoofable/insufficiently validated network attribute (loopback REMOTE_ADDR). No specific function names, class names, or API paths beyond what the NVD description provides are asserted here. No public proof-of-concept, exploit code, or Nuclei template is available.

The affected version range is Grav 2.0.22 before 2.1.7. Note that the Clockwork profiler is typically intended for development use; production exposure through a same-host proxy is the primary risk condition.

Exploitation Scenarios

Based strictly on the NVD description, the exploit chain is inferred at the vulnerability-class level. No public PoC is available.

1. Reconnaissance / Target Identification. The attacker identifies a Grav installation running a version in the affected range (2.0.22 ≤ version < 2.1.7) that is fronted by a same-host HTTP proxy. Fingerprinting can be performed by observing Grav-specific HTTP responses and headers.

2. Triggering the Flaw. The attacker sends crafted HTTP requests to the Grav application through the reverse proxy. Because the proxy connects to the backend over the loopback interface, the application observes a loopback REMOTE_ADDR. The Clockwork profiler, trusting that value, treats the attacker's request as a trusted local request and skips authentication for the profiler records.

3. Payload / Execution (vulnerability-class level). Exploitation does not require a crafted memory-corruption payload; it relies on request routing through the proxy so that the loopback trust check is satisfied. The attacker requests the profiler output, which the application returns without a valid session or credentials. Specific URLs and parameters are not provided by the source data and are therefore not asserted.

4. Post-Exploitation Impact. Successful retrieval of profiler records exposes system and plugin configuration, secrets, request metadata, and queries. The attacker can harvest credentials, API keys, database query contents, and configuration detail to pivot further into the environment or facilitate follow-on attacks. No integrity or availability impact is expected from this CVE alone.

Impact Assessment

The confidentiality impact is High (C:H). Exposed data can include system configuration, plugin configuration, application secrets, request metadata (including potentially cookies or authorization headers captured in profiler records), and executed queries — providing high-value reconnaissance and credential material. Integrity and availability are unaffected (I:N, A:N).

The blast radius is bounded by the requirement that a same-host HTTP proxy fronts the Grav deployment, a common production topology. Any such unauthenticated, internet-reachable deployment is at risk. Per CVE data, EPSS is not yet scored, there is no CISA KEV listing, no public exploit, and no vendor workaround provided. Business impact centers on sensitive-information disclosure leading to credential compromise, lateral movement enablement, and potential regulatory or compliance exposure stemming from leaked secrets and configuration.

Detection Guidance

Sigma Rule

title: Grav Clockwork Profiler Authentication Bypass via Loopback Trust
id: 8f3c2a1e-5b7d-4c9a-9e21-7a6d4f0b3c88
status: experimental
description: Detects access to Grav Clockwork profiler endpoints from requests the application treats as loopback behind a same-host proxy.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109325
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/__clockwork'
      - 'clockwork'
  selection_method:
    cs-method: 'GET'
  condition: selection_path and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate developer access to the profiler in non-production environments
level: high

YARA Rule

rule CVE_2026_109325_Grav_Clockwork_Exposure
{
    meta:
        author = "valtersit.com"
        description = "Detects Grav Clockwork profiler request patterns associated with CVE-2026-109325"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109325"
        date = "2026-01-01"

    strings:
        $p1 = "/__clockwork" ascii wide nocase
        $p2 = "clockwork" ascii wide nocase
        $g1 = "Grav" ascii wide nocase
        $g2 = "grav-site" ascii wide nocase

    condition:
        (any of ($p1, $p2)) and (any of ($g1, $g2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109325 Grav Clockwork Profiler Authentication Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/__clockwork"; nocase; http.uri; content:"clockwork"; nocase; classtype:attempted-recon; reference:cve,2026-109325; sid:2026109325; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method == "GET" and url.path : "*clockwork*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=access_log
| search uri_path="*clockwork*" OR uri_query="*clockwork*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(status) as status_codes by clientip, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,grav,cve-2026-109325,">
  <rule id="1009325" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">clockwork</field>
    <description>CVE-2026-109325: Access attempt to Grav Clockwork profiler (possible authentication bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor-fixed version reportedly begins at 2.1.7 per the CVE description; no tracked source provides patch artifacts, advisories, or commit references. The following are conservative measures.

1. Immediate Mitigations (no patch available):

   • Disable the Clockwork profiler in production environments; the profiler is a development/debugging facility and should not be internet-exposed.
   • Ensure the application does not trust loopback REMOTE_ADDR values; where possible, configure the reverse proxy to pass and the application to honor a trusted client-IP header (X-Forwarded-For) rather than the loopback source address, and restrict profiler endpoints by network ACL.
   • Block external access to profiler-related paths at the proxy/WAF layer.
   • Place the Grav admin and profiler surfaces behind VPN or IP allowlisting.

2. Patch/Upgrade Steps:

   • Upgrade Grav to 2.1.7 or later, which the CVE description identifies as the first fixed version.
   • Since no vendor advisory or patch artifact is confirmed by tracked sources, verify the fix directly with the Grav project before relying on version numbers alone.

3. Long-Term Hardening:

   • Run Grav without development profiler components in production.
   • Adopt a zero-trust posture for loopback-originating requests; never treat REMOTE_ADDR == 127.0.0.1 as authentication.
   • Continuously inventory exposed debug/profiler endpoints and enforce least privilege on secrets and configuration.
   • Monitor for anomalous profiler-path access and rotate any secrets that may have been exposed.

References

• NVD — CVE-2026-109325: https://nvd.nist.gov/vuln/detail/CVE-2026-109325
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Grav CMS project: https://getgrav.org/
• FIRST EPSS: not yet scored for this CVE (no value available)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109325 per the provided data. CISA KEV: not listed. Public PoC: none. Nuclei template: none.