[IT-SecNots] [Security-news] Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-core-2026-008

Project: Drupal core [1]
Date: 2026-June-02
Security risk: *Moderately critical* 10 ∕ 25
AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Server-side request forgery

Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 ||
 >=11.3.0 <11.3.12 || 11.0.* || 11.1.*
CVE IDs: CVE-2026-55807
Description: 
The Media module comes with support for oEmbed. The oEmbed specification
contains two discovery mechanisms, via providers.json and via URL discovery.

The URL discovery code could be leveraged to trick Drupal into making
server-side requests to any URL.

Solution: 
Install the latest version:

*Drupal 11*

 * If you use Drupal 11.3.x, update to Drupal 11.3.12 [3].
 * If you use Drupal 11.2.x, update to Drupal 11.2.14 [4].

*Drupal 10*

 * If you use Drupal 10.6.x, update to Drupal 10.6.11 [5].
 * If you use Drupal 10.5.x, update to Drupal 10.5.12 [6].

Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do
not receive security coverage. (Drupal 8 [7] and Drupal 9 [8] have both
reached end-of-life.)

.. Required site changes for URL discovery

Most users of the oEmbed functionality in Drupal likely use providers.json to
define known providers (such as YouTube and Vimeo) for embedding content.

If you are using URL discovery, you now need to set a list of trusted oEmbed
discovery hosts in settings.php.

This is an array containing a series of regular expressions for matching host
names for discovery. It follows the same pattern as the existing trusted
hosts settings [9].

Example:

// Only allow URL discovery from example.com.
$settings['media_oembed_discovery_trusted_host_patterns'] = [
   '^example\.com$',
];
Reported By: 
 * Hamed Kohi (0xhamy) [10]
 * assaf alassaf (ama62) [11]
 * Albert Skibinski (askibinski) [12]
 * Jon Minder (ayalon) [13]
 * Lautaro Casanova (betah4k) [14]
 * Gabe Sullice (gabesullice) [15]
 * John Morahan (john morahan) [16]
 * Michael Winser (michaelwinser) [17]
 * nbanderson [18]
 * offensive-ai [19]
 * Francesco Placella (plach) [20]
 * quynh ho (qquynh) [21]
 * Himanshu Anand (unknownhad) [22]

Fixed By: 
 * Lee Rowlands (larowlan) [23] of the Drupal Security Team
 * Dave Long (longwave) [24] of the Drupal Security Team
 * Drew Webber (mcdruid) [25] of the Drupal Security Team
 * Adam G-H (phenaproxima) [26]
 * Sean Blommaert (seanb) [27]

Coordinated By: 
 * Benji Fisher (benjifisher) [28] of the Drupal Security Team
 * cilefen  (cilefen) [29] of the Drupal Security Team
 * Damien McKenna (damienmckenna) [30] of the Drupal Security Team
 * Mori Sugimoto (dokumori) [31] of the Drupal Security Team
 * Greg Knaddison (greggles) [32] of the Drupal Security Team
 * Lee Rowlands (larowlan) [33] of the Drupal Security Team
 * Dave Long (longwave) [34] of the Drupal Security Team
 * Drew Webber (mcdruid) [35] of the Drupal Security Team
 * James Gilliland (neclimdul) [36] of the Drupal Security Team
 * Juraj Nemec (poker10) [37] of the Drupal Security Team
 * Jess  (xjm) [38] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185053-drupal-security/-/work_items/1
[39]
------------------------------------------------------------------------------
Contribution record [40]

[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/11.3.12
[4] https://www.drupal.org/project/drupal/releases/11.2.14
[5] https://www.drupal.org/project/drupal/releases/10.6.11
[6] https://www.drupal.org/project/drupal/releases/10.5.12
[7] https://www.drupal.org/psa-2021-06-29
[8] https://www.drupal.org/psa-2023-11-01
[9]  
https://www.drupal.org/docs/getting-started/installing-drupal/trusted-host-settings
[10] https://www.drupal.org/u/0xhamy
[11] https://www.drupal.org/u/ama62
[12] https://www.drupal.org/u/askibinski
[13] https://www.drupal.org/u/ayalon
[14] https://www.drupal.org/u/betah4k
[15] https://www.drupal.org/u/gabesullice
[16] https://www.drupal.org/u/john-morahan
[17] https://www.drupal.org/u/michaelwinser
[18] https://www.drupal.org/u/nbanderson
[19] https://www.drupal.org/u/offensive-ai
[20] https://www.drupal.org/u/plach
[21] https://www.drupal.org/u/qquynh
[22] https://www.drupal.org/u/unknownhad
[23] https://www.drupal.org/u/larowlan
[24] https://www.drupal.org/u/longwave
[25] https://www.drupal.org/u/mcdruid
[26] https://www.drupal.org/u/phenaproxima
[27] https://www.drupal.org/u/seanb
[28] https://www.drupal.org/u/benjifisher
[29] https://www.drupal.org/u/cilefen
[30] https://www.drupal.org/u/damienmckenna
[31] https://www.drupal.org/u/dokumori
[32] https://www.drupal.org/u/greggles
[33] https://www.drupal.org/u/larowlan
[34] https://www.drupal.org/u/longwave
[35] https://www.drupal.org/u/mcdruid
[36] https://www.drupal.org/u/neclimdul
[37] https://www.drupal.org/u/poker10
[38] https://www.drupal.org/u/xjm
[39]  
https://git.drupalcode.org/security/185053-drupal-security/-/work_items/1
[40]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3593377

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at