CVE-2026-38527: SSRF in Webkul Krayin CRM

The SSRF vulnerability in Webkul Krayin CRM allows an attacker to bypass security controls and make requests to internal services that are not directly accessible from the outside. This could involve scanning internal networks for open ports, accessing sensitive configuration files, or even interacting with internal APIs. Successful exploitation could lead to data exfiltration, privilege escalation, or further compromise of the underlying infrastructure. The ability to initiate requests on behalf of the application significantly expands the attack surface, potentially impacting other systems within the internal network. This vulnerability shares similarities with other SSRF exploits where internal services are inadvertently exposed.

1. Reserved2026-04-06
2. Published2026-04-14
3. Modified2026-04-15
4. EPSS updated2026-04-22

The primary mitigation for CVE-2026-38527 is to upgrade Webkul Krayin CRM to version 2.3.0 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the /settings/webhooks/create endpoint using a Web Application Firewall (WAF) or proxy server, blocking requests to internal IP addresses or sensitive internal services. Validate and sanitize all user-supplied input to prevent malicious URLs from being used in requests. Regularly review and update firewall rules to minimize the attack surface.

Last updated

2.2.3recently