CVE-2026-55807

Description

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

PUBLISHED Reserved 2026-06-17 | Published 2026-07-10 | Updated 2026-07-13 | Assigner drupal

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Credits

Hamed Kohi (0xhamy) finder

assaf alassaf (ama62) finder

Albert Skibinski (askibinski) finder

Jon Minder (ayalon) finder

Lautaro Casanova (betah4k) finder

Gabe Sullice (gabesullice) finder

John Morahan (john morahan) finder

Michael Winser (michaelwinser) finder

nbanderson finder

offensive-ai finder

Francesco Placella (plach) finder

quynh ho (qquynh) finder

Himanshu Anand (unknownhad) finder

Lee Rowlands (larowlan) remediation developer

Dave Long (longwave) remediation developer

Drew Webber (mcdruid) remediation developer

Adam G-H (phenaproxima) remediation developer

Sean Blommaert (seanb) remediation developer

Benji Fisher (benjifisher) coordinator

cilefen (cilefen) coordinator

Damien McKenna (damienmckenna) coordinator

Mori Sugimoto (dokumori) coordinator

Greg Knaddison (greggles) coordinator

Lee Rowlands (larowlan) coordinator

Dave Long (longwave) coordinator

Drew Webber (mcdruid) coordinator

James Gilliland (neclimdul) coordinator

Juraj Nemec (poker10) coordinator

Jess (xjm) coordinator

References

www.drupal.org/sa-core-2026-008

cve.org (CVE-2026-55807)

nvd.nist.gov (CVE-2026-55807)

Download JSON