CVE-2026-55807 PUBLISHED

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1..

• Hamed Kohi (0xhamy) finder
• assaf alassaf (ama62) finder
• Albert Skibinski (askibinski) finder
• Jon Minder (ayalon) finder
• Lautaro Casanova (betah4k) finder
• Gabe Sullice (gabesullice) finder
• John Morahan (john morahan) finder
• Michael Winser (michaelwinser) finder
• nbanderson finder
• offensive-ai finder
• Francesco Placella (plach) finder
• quynh ho (qquynh) finder
• Himanshu Anand (unknownhad) finder
• Lee Rowlands (larowlan) remediation developer
• Dave Long (longwave) remediation developer
• Drew Webber (mcdruid) remediation developer
• Adam G-H (phenaproxima) remediation developer
• Sean Blommaert (seanb) remediation developer
• Benji Fisher (benjifisher) coordinator
• cilefen (cilefen) coordinator
• Damien McKenna (damienmckenna) coordinator
• Mori Sugimoto (dokumori) coordinator
• Greg Knaddison (greggles) coordinator
• Lee Rowlands (larowlan) coordinator
• Dave Long (longwave) coordinator
• Drew Webber (mcdruid) coordinator
• James Gilliland (neclimdul) coordinator
• Juraj Nemec (poker10) coordinator
• Jess (xjm) coordinator

• https://www.drupal.org/sa-core-2026-008

• CWE-918 Server-Side Request Forgery (SSRF) CWE

• CAPEC-664 Server Side Request Forgery