Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
『The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.』 CVE-2026-55807 Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 https://www.drupal.org/sa-core-2026-008
Post summary
The statement announces a new Drupal core vulnerability (CVE-2026-55807) that enables server-side request forgery but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | drupal | drupal | - | - | - |