CVE-2026-56708: Time-of-check Time-of-use (TOCTOU) Race Condition in getgrav grav

The Grav API plugin versions prior to 1.0.16 contain a TOCTOU race condition vulnerability in webhook delivery that leads to SSRF. The vulnerability allows an attacker who controls the authoritative DNS for a configured webhook hostname to respond to hostname validation queries with public IP addresses and to delivery queries with private IP addresses. This bypasses hostname validation and allows the attacker to reach internal network resources that would otherwise be inaccessible.

An attacker can bypass hostname validation in webhook delivery, potentially accessing internal network resources through SSRF. This could lead to unauthorized internal network access, which may facilitate further attacks or data exposure within the internal environment. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality and integrity.

A fix is available in Grav API plugin version 1.0.16. Users should upgrade to version 1.0.16 or later to remediate this vulnerability. Until then, restricting DNS control for webhook hostnames and monitoring webhook configurations may reduce exposure.