CVE-2026-13233: Drupal OpenAI Provider SSRF Vulnerability

CVE-2026-13233 Overview

CVE-2026-13233 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting the Drupal OpenAI Provider contributed module. The flaw allows an authenticated attacker with high privileges to coerce the server into issuing HTTP requests to attacker-controlled or internal destinations. Affected releases include OpenAI Provider versions 0.0.0 through 1.1.1, and 1.2.0 through 1.2.2. Successful exploitation can result in limited disclosure of information and limited integrity impact on adjacent systems reachable from the Drupal host.

Critical Impact
Authenticated attackers can leverage the Drupal OpenAI Provider module to make server-side requests to internal endpoints, potentially exposing metadata services or internal APIs.

Affected Products

Drupal OpenAI Provider 0.0.0 through 1.1.1
Drupal OpenAI Provider 1.2.0 through 1.2.2
Drupal sites running the OpenAI Provider contributed module

Discovery Timeline

2026-07-10 - CVE-2026-13233 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-13233

Vulnerability Analysis

The Drupal OpenAI Provider module integrates Drupal with OpenAI-compatible API endpoints. The vulnerability arises when the module accepts a user-supplied endpoint or URL parameter and issues an outbound HTTP request without sufficient validation of the target host. An attacker with configuration privileges can substitute the intended OpenAI endpoint with an internal or attacker-controlled URL. The server then performs the request on behalf of the attacker, returning response data or side effects to the caller.

The attack requires network access to the Drupal application and elevated privileges within the Drupal administrative interface. No user interaction is required beyond the attacker's own submission. Impact is limited to partial confidentiality and integrity exposure, with no direct availability impact.

Root Cause

The root cause is missing or insufficient validation of destination URLs supplied to the OpenAI Provider module before the module issues server-side HTTP requests. Without an allowlist of permitted hosts or protocol restrictions, the module treats attacker-supplied endpoints as legitimate API targets. This behavior aligns with the pattern described in CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation is network-based. An attacker holding administrative privileges over the OpenAI Provider configuration modifies the API endpoint URL to point at an internal resource such as a cloud metadata service, an internal management API, or a loopback service. When the module invokes the provider, the Drupal server issues the outbound request and returns portions of the response. Attack complexity is elevated because the attacker must already possess high privileges within the Drupal instance.

No verified public exploit code is available. Refer to the Drupal Security Advisory for technical details.

Detection Methods for CVE-2026-13233

Indicators of Compromise

Outbound HTTP requests from Drupal web servers to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints such as 169.254.169.254.
Unexpected modifications to the OpenAI Provider configuration entity, including changes to the API base URL field.
Drupal watchdog log entries showing HTTP client errors originating from the OpenAI Provider module against non-OpenAI hosts.

Detection Strategies

Monitor Drupal configuration change events for the OpenAI Provider module and alert on API endpoint URL changes.
Inspect egress web proxy logs for requests originating from Drupal application servers that target private address space or link-local addresses.
Correlate administrative session activity with configuration changes to the OpenAI Provider to identify anomalous privilege use.

Monitoring Recommendations

Enable verbose logging on the Drupal HTTP client and forward logs to a centralized SIEM for retention and analysis.
Alert on any Drupal-originated request to cloud instance metadata endpoints, which should never be a legitimate destination for the OpenAI Provider module.
Track privileged administrator logins that immediately precede changes to AI provider configuration entities.

How to Mitigate CVE-2026-13233

Immediate Actions Required

Upgrade the Drupal OpenAI Provider module to a version beyond 1.2.2 that includes the vendor fix, per the Drupal Security Advisory.
Audit accounts with permission to modify AI provider configuration and remove unnecessary privilege assignments.
Review recent changes to OpenAI Provider configuration for unauthorized modifications to API endpoint URLs.

Patch Information

The vendor has published guidance in the Drupal Security Advisory SA-CONTRIB-2026-053. Site administrators should update the OpenAI Provider module to the fixed release identified in that advisory. Verify the installed module version using drush pm:list --type=module | grep openai_provider after the update.

Workarounds

Restrict the administer openai_provider (or equivalent) permission to a minimal set of trusted administrators until the module is patched.
Deploy an egress proxy or network policy that blocks outbound requests from Drupal application servers to internal IP ranges and cloud metadata endpoints.
Configure Drupal to route all outbound HTTP traffic through an allowlisted proxy that permits only known OpenAI API hostnames.

bash

# Configuration example: restrict egress from Drupal host to metadata service
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT