CVE-2026-55807 Overview
CVE-2026-55807 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Drupal core. An authenticated attacker with low privileges can coerce the server into issuing HTTP requests to attacker-chosen destinations. The flaw affects multiple supported Drupal core branches and is tracked by the vendor as advisory SA-CORE-2026-008.
Exploitation requires network access and low-privilege credentials, and the attack complexity is high. Successful exploitation yields limited confidentiality impact with no direct integrity or availability effect. No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
An authenticated user can abuse Drupal core to send crafted server-side requests, potentially reaching internal services that are not exposed to the public network.
Affected Products
- Drupal core 0.0.0 through 10.5.12
- Drupal core 10.6.0 through 10.6.11
- Drupal core 11.2.0 through 11.2.14 and 11.3.0 through 11.3.12
- Drupal core 11.0.* and 11.1.* branches
Discovery Timeline
- 2026-07-10 - CVE-2026-55807 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55807
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery (SSRF) issue in Drupal core. Drupal accepts a user-influenced URL or resource identifier and dispatches an HTTP request from the server without sufficient validation of the destination. An authenticated attacker can supply a URL pointing to internal hosts, loopback interfaces, or cloud metadata endpoints.
Because the request originates from the Drupal server, network-level restrictions that block external clients do not apply. The impact vector is confined to confidentiality, so an attacker may retrieve response content or infer internal network topology. Attack complexity is rated high, indicating that specific conditions must be met to trigger the vulnerable code path reliably.
Root Cause
The root cause is insufficient validation of a request destination before Drupal core issues an outbound HTTP request. The CWE classification is [CWE-918] Server-Side Request Forgery. The vendor has not published low-level code details in the public advisory.
Attack Vector
The attack vector is network-based. An authenticated user with low privileges submits input that Drupal uses to construct an outbound request. The server then contacts the attacker-specified endpoint, which may be an internal service, a metadata API, or another host reachable from the Drupal instance. See the Drupal Security Advisory for exploitation preconditions.
No verified exploit code is available. Refer to the Drupal Security Advisory for authoritative technical details.
Detection Methods for CVE-2026-55807
Indicators of Compromise
- Outbound HTTP requests from the Drupal web server process to internal RFC1918 addresses or loopback interfaces without a corresponding business reason.
- Requests from the Drupal server to cloud metadata endpoints such as 169.254.169.254.
- Unusual User-Agent strings sourced from PHP or Drupal HTTP clients in outbound proxy logs.
Detection Strategies
- Inspect Drupal web server logs for authenticated requests containing URL-shaped parameters that precede unusual outbound connections.
- Correlate authenticated session activity with egress firewall logs to identify server-initiated requests to non-standard destinations.
- Enable web application firewall rules that flag user-supplied URLs targeting private address space.
Monitoring Recommendations
- Monitor egress traffic from Drupal application servers and alert on connections to internal subnets or metadata IPs.
- Track failed and successful outbound HTTP requests originating from PHP-FPM or the Drupal worker process.
- Baseline normal outbound destinations for the Drupal host and alert on deviations.
How to Mitigate CVE-2026-55807
Immediate Actions Required
- Upgrade Drupal core to a fixed release as identified in advisory SA-CORE-2026-008.
- Review authenticated user accounts and remove unused low-privilege accounts that could be abused for exploitation.
- Restrict egress network access from Drupal servers using host-based or perimeter firewall rules.
Patch Information
Apply the fixed Drupal core versions published in the Drupal Security Advisory. Affected branches include 10.5.x, 10.6.x, 11.0.x, 11.1.x, 11.2.x, and 11.3.x. Upgrade to the corresponding patched release for your branch.
Workarounds
- Block outbound connections from the Drupal server to internal networks and cloud metadata endpoints at the network layer.
- Route all outbound HTTP traffic from Drupal through a filtering egress proxy that enforces a destination allowlist.
- Temporarily disable or restrict features that accept user-supplied URLs until the patch is applied.
# Example egress restriction using iptables to block cloud metadata endpoint
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
