[IT-SecNots] [Security-news] Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-176

Project: Cloud [1]
Project machine name: cloud
Date: 2026-September-23
Security risk: *Critical* 15 ∕ 25
AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Remote code execution

Affected versions: <7.0.1
CVE IDs: CVE-2026-96375
Description: 
The Cloud module enables users to manage cloud infrastructure through Drupal.

The Kubernetes and VMware integrations do not properly validate TLS
certificates when connecting to remote API endpoints. An attacker who can
intercept these connections may obtain secret tokens or other credentials,
potentially allowing unauthorized access to the connected infrastructure.

Solution: 
If you use Cloud, install the latest version and configure certificates
appropriately:

 * If you use the 7.0.0 branch, update to 7.0.1 [3].

The update enables TLS certificate verification for Kubernetes and VMware
connections. Sites using a private certificate authority must configure the
CA certificate path for the affected connection or ensure that the issuing CA
is trusted by the PHP runtime. Run the Drupal database updates and rebuild
caches after upgrading.

Reported By: 
 * Kalle Kipinä (kekkis) [4]

Fixed By: 
 * AI Yas (ai_yas) [5]
 * baldwinlouie [6]
 * Yas Naoi (yas) [7]

Coordinated By: 
 * Swan Kalata (akalata) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Juraj Nemec (poker10) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/cloud
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/cloud/releases/7.0.1
[4] https://www.drupal.org/u/kekkis
[5] https://www.drupal.org/u/ai_yas
[6] https://www.drupal.org/u/baldwinlouie
[7] https://www.drupal.org/u/yas
[8] https://www.drupal.org/u/akalata
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3622599

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at