CVE-2026-73474 Overview
CVE-2026-73474 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Drupal Entity Share Websub contributed module. The flaw affects Entity Share Websub versions 0.0.0 through 1.1.2. An unauthenticated remote attacker can coerce the Drupal application to issue HTTP requests to attacker-chosen destinations. This exposes internal services, metadata endpoints, and non-public network resources that would otherwise be unreachable.
Critical Impact
Unauthenticated network-based SSRF allowing attackers to pivot requests through vulnerable Drupal sites to internal systems and disclose limited confidential information.
Affected Products
- Drupal Entity Share Websub module versions 0.0.0 to 1.1.2
- Drupal sites with the Entity Share Websub contributed module enabled
- Any downstream distribution bundling Entity Share Websub <= 1.1.2
Discovery Timeline
- 2026-09-02 - CVE-2026-73474 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-73474
Vulnerability Analysis
The Entity Share Websub module implements the WebSub publish-subscribe protocol on top of the Entity Share framework. WebSub requires the hub to fetch content from publisher-supplied URLs. The vulnerable module fails to validate or restrict those URLs before performing outbound HTTP requests. An attacker submits a crafted subscription or callback that references an internal address. The server then dispatches a request on the attacker's behalf, returning or acting on the response.
The confidentiality impact is limited but real. Attackers can enumerate internal services, reach cloud instance metadata endpoints on unhardened hosts, and probe non-routable networks. There is no direct impact to integrity or availability based on the published scoring vector.
Root Cause
The root cause is insufficient validation of user-controlled URLs before invoking the HTTP client. WebSub flows require the server to act on remote references, but the module does not enforce an allowlist of destination hosts, block private and link-local ranges, or restrict redirect targets. This maps directly to CWE-918: Server-Side Request Forgery.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker submits a WebSub-related request containing a URL pointing to an internal resource such as http://127.0.0.1, http://169.254.169.254/latest/meta-data/, or an internal service hostname. The Drupal server processes the request and issues the outbound call. The attacker infers information from response content, timing, or error signals.
No verified public proof-of-concept code is available. Review the Drupal Security Advisory for authoritative technical details.
Detection Methods for CVE-2026-73474
Indicators of Compromise
- Outbound HTTP requests from the Drupal web server to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 127.0.0.0/8.
- Requests from the Drupal PHP process to cloud metadata endpoints, notably 169.254.169.254 on AWS, Azure, and GCP.
- Unexpected WebSub subscription entries in the Entity Share Websub tables containing internal or loopback URLs.
- Web server access logs showing anonymous POST requests to WebSub subscription or callback routes exposed by the module.
Detection Strategies
- Inspect PHP-FPM and web server egress traffic for connections initiated by Drupal to RFC1918 addresses or cloud metadata IPs.
- Search Drupal watchdog and dblog entries for HTTP client errors referencing internal hostnames or refused connections.
- Correlate anonymous requests to Entity Share Websub endpoints with subsequent outbound HTTP activity from the same worker process.
Monitoring Recommendations
- Enable egress logging at the network boundary and alert on Drupal-origin traffic destined for internal subnets.
- Instrument the PHP HTTP client with Guzzle middleware or reverse-proxy logging to capture destination hosts of module-initiated requests.
- Baseline normal WebSub hub and callback destinations, and alert on deviations to previously unseen hosts.
How to Mitigate CVE-2026-73474
Immediate Actions Required
- Upgrade Entity Share Websub to a release later than 1.1.2 as published in the Drupal security advisory.
- If a fixed release is unavailable, disable and uninstall the Entity Share Websub module until a patch is applied.
- Restrict outbound network access from the Drupal application server to only required WebSub hubs and publishers.
- Block Drupal egress to cloud metadata endpoints such as 169.254.169.254 using host firewall rules or IMDSv2 enforcement.
Patch Information
Refer to the Drupal Security Advisory SA-CONTRIB-2026-097 for the fixed release version and upgrade instructions. Apply the update using composer update drupal/entity_share_websub followed by drush updatedb and cache rebuild.
Workarounds
- Uninstall the Entity Share Websub module if WebSub functionality is not required.
- Place the Drupal server behind an egress proxy that enforces an allowlist of permitted outbound destinations.
- Deny requests to private, loopback, and link-local address ranges at the network layer for the Drupal worker pool.
# Configuration example: block Drupal egress to internal and metadata ranges
sudo iptables -I OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
sudo iptables -I OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
sudo iptables -I OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
sudo iptables -I OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
# Remove the vulnerable module until a fix is applied
composer remove drupal/entity_share_websub
drush cache:rebuild
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
