CVE-2026-55806: Drupal Core Open Redirect Vulnerability

CVE-2026-55806 Overview

CVE-2026-55806 is an open redirect vulnerability in Drupal core that enables content spoofing attacks. The flaw is classified under [CWE-601] URL Redirection to Untrusted Site. Attackers can craft URLs that appear to originate from a trusted Drupal site but redirect visitors to attacker-controlled destinations. The vulnerability affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, and 11.3.0 to 11.3.12, as well as all 11.0.* and 11.1.* releases. Drupal published advisory sa-core-2026-007 to address the issue.

Critical Impact
Attackers can redirect users from a trusted Drupal domain to malicious sites, enabling phishing campaigns and content spoofing against site visitors.

Affected Products

Drupal core 0.0.0 through 10.5.12 and 10.6.0 through 10.6.11
Drupal core 11.0.*, 11.1.*, and 11.2.0 through 11.2.14
Drupal core 11.3.0 through 11.3.12

Discovery Timeline

2026-07-10 - CVE-2026-55806 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55806

Vulnerability Analysis

The vulnerability sits in Drupal core's URL handling logic, where a redirect parameter accepts destinations without validating that the target belongs to the current site. An attacker crafts a link pointing at a legitimate Drupal endpoint but includes a redirect argument that references an external domain. When a user follows the link, Drupal issues an HTTP redirect to the attacker's host. Because the initial hostname belongs to the trusted site, the user has fewer visual cues that the destination is malicious.

Content spoofing amplifies the impact. Attackers can pair the redirect with cloned login pages or fake notices that appear to be part of the legitimate Drupal application. The EPSS probability of 0.206% reflects a low but non-trivial likelihood of exploitation activity. No public proof-of-concept or in-the-wild exploitation has been reported at time of publication.

Root Cause

Drupal core fails to validate that the redirect target resolves to an internal, same-origin URL before issuing the HTTP Location response. Insufficient allowlisting of redirect destinations lets attacker-supplied absolute URLs pass through the redirect handler unchanged.

Attack Vector

The attack requires network access only, with no authentication or user interaction beyond clicking a link. Attackers deliver a crafted URL via email, chat, social media, or search engine ranking abuse. Drupal returns a redirect to the attacker-controlled endpoint, which typically hosts phishing content branded to match the origin site. See the Drupal Security Advisory for technical specifics.

// Verified exploit code is not available for this CVE.
// Refer to the Drupal Security Advisory sa-core-2026-007 for details.

Detection Methods for CVE-2026-55806

Indicators of Compromise

HTTP 302 or 301 responses from Drupal endpoints containing external hostnames in the Location header
Access log entries where redirect parameters (for example destination=) hold absolute URLs pointing to third-party domains
Referrer chains that begin on a trusted Drupal domain and terminate on newly registered or low-reputation hosts

Detection Strategies

Parse web server access logs for query parameters that contain fully qualified URLs with schemes such as http:// or https:// targeting non-owned domains
Alert when Drupal returns redirects whose Location header host does not match the request Host header
Correlate outbound user traffic to phishing infrastructure with prior visits to Drupal-hosted URLs carrying redirect parameters

Monitoring Recommendations

Enable structured logging on the Drupal reverse proxy and forward events to a central analytics platform for query and correlation
Track sudden spikes in redirect responses from Drupal endpoints, particularly from unauthenticated sessions
Monitor threat intelligence feeds for typosquatted domains referencing your Drupal site as a redirect source

How to Mitigate CVE-2026-55806

Immediate Actions Required

Upgrade Drupal core to a fixed release per Drupal Security Advisory sa-core-2026-007
Audit custom modules and themes for use of the affected redirect APIs and confirm they rely on patched core routines
Review recent access logs for redirect parameters referencing external hostnames and investigate any user reports of phishing

Patch Information

Drupal released fixes in advisory sa-core-2026-007. Administrators should upgrade to a version later than 10.5.12, 10.6.11, 11.2.14, or 11.3.12, and off of the end-of-life 11.0.* and 11.1.* branches. Consult the Drupal Security Advisory for the exact fixed versions and upgrade instructions.

Workarounds

Configure a web application firewall rule that blocks requests where redirect parameters contain absolute external URLs
Restrict the destination query parameter at the reverse proxy to relative paths only
Add an interstitial warning page for any outbound redirect to a domain outside the site's allowlist

bash

# Example WAF rule concept: block external redirect targets in the destination parameter
# Adapt syntax to your WAF (ModSecurity, NGINX, Cloudflare, etc.)
SecRule ARGS:destination "@rx ^(https?:)?//" \
    "id:1055806,phase:2,deny,status:400,msg:'Blocked open redirect attempt (CVE-2026-55806)'"