Vulnerability advisory

CVE-2026-55807

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

Published Jul 10, 2026Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2026-55807DRUPAL-CORE-2026-008

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT git.drupalcode.org/project/drupal ↗
All commits before aa50cd50d157c4f8c67d08bb81b600c88fab5f3d	`aa50cd50d157c4f8c67d08bb81b600c88fab5f3d`
Not specified	`140f94ff1051644c4416c7ed30cc5dd1f14507b2`
Not specified	`09d3d7fd4a638e3cc53eff60922765ad3af19c66`
920f3f7ab87ba2cca9191ec292d356197de4bc0a to before 67d182d2206d154708773d56d0fed0627cf7a22c	`67d182d2206d154708773d56d0fed0627cf7a22c`
338d58439d5b59d92ac9519ad81ffd916b673841 to before bea43c2292caaae5bbdd8eff9afbaacabfac2ff1	`bea43c2292caaae5bbdd8eff9afbaacabfac2ff1`
ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before 9b9e9b073cc79cfe537d15ef7240367c0586ae28	`9b9e9b073cc79cfe537d15ef7240367c0586ae28`
GIT github.com/drupal/drupal ↗
All commits before aa50cd50d157c4f8c67d08bb81b600c88fab5f3d	`aa50cd50d157c4f8c67d08bb81b600c88fab5f3d`
920f3f7ab87ba2cca9191ec292d356197de4bc0a to before 67d182d2206d154708773d56d0fed0627cf7a22c	`67d182d2206d154708773d56d0fed0627cf7a22c`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before bea43c2292caaae5bbdd8eff9afbaacabfac2ff1	`bea43c2292caaae5bbdd8eff9afbaacabfac2ff1`
ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before 9b9e9b073cc79cfe537d15ef7240367c0586ae28	`9b9e9b073cc79cfe537d15ef7240367c0586ae28`
Also listed as affected (127) `10.5.11` `10.6.10` `11.2.13` `11.3.11` `10.6.8` `11.3.9` `11.3.8` `10.5.8` `10.6.6` `11.2.10` `11.3.6` `10.6.5` `11.3.5` `10.6.4` `11.3.4` `10.6.3` `11.3.3` `10.6.2` `11.3.2` `11.3.1` `10.6.1` `11.3.0` `10.6.0` `11.2.9` `10.5.7` `10.5.5` `11.2.6` `10.5.4` `11.2.5` `10.5.3` `11.2.4` `10.5.2` `11.2.3` `10.5.1` `11.2.2` `11.2.1` `11.2.0` `10.5.0` `10.5.0-rc1` `10.5.0-beta1` `11.1.0-rc1` `11.1.0-beta1` `11.0.0-beta1` `11.0.0-alpha1` `10.1.0-alpha1` `10.0.0-alpha5` `10.0.0-alpha4` `10.0.0-alpha3` `10.0.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0` `8.0.0-rc4` `8.0.0-rc3` `8.0.0-rc2` `8.0.0-rc1` `8.0.0-beta16` `8.0.0-beta15` `8.0.0-beta14` `8.0.0-beta13` `8.0.0-beta12` `8.0.0-beta11` `8.0.0-beta10` `8.0.0-beta9` `8.0.0-beta7` `8.0.0-beta6` `8.0.0-beta5` `8.0.0-beta4` `8.0.0-beta3` `8.0.0-beta2` `8.0.0-beta1` `8.0.0-alpha15` `8.0.0-alpha14` `8.0-alpha13` `8.0-alpha12` `8.0-alpha11` `8.0-alpha10` `8.0-alpha9` `8.0-alpha8` `8.0-alpha7` `8.0-alpha6` `8.0-alpha5` `8.0-alpha4` `8.0-alpha3` `8.0-alpha2` `7.0` `7.0-rc-4` `7.0-rc-3` `7.0-rc-2` `7.0-rc-1` `7.0-beta3` `7.0-beta2` `7.0-beta1` `7.0-alpha7` `7.0-alpha6` `7.0-alpha5` `7.0-alpha4` `7.0-alpha3` `7.0-alpha2` `7.0-alpha1` `7.0-unstable-10` `7.0-unstable-7` `7.0-unstable-6` `7.0-unstable-5` `7.0-unstable-4` `7.0-unstable-3` `7.0-unstable-2` `7.0-unstable-1` `6.0-rc-3` `6.0-rc-2` `6.0-rc-1` `6.0-beta-4` `6.0-beta-3` `6.0-beta-2` `6.0-beta-1` `5.0-rc-2` `5.0-rc-1` `5.0-beta-2` `5.0-beta-1` `3.0.1` `2.0` `1.0` `start` `11.2.0-rc2` `11.2.0-beta1` `11.2.0-alpha1`

Description

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1..

CVE-2026-55807

Affected versions

Repository

Description

References