Is CVE-2026-126736 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126736 being exploited in the wild.

How severe is CVE-2026-126736?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal Entity Print <2.20.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print ECOSYSTEM:introduced=0,fixed=2.20.0.

How is CVE-2026-126736 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126736?

Check whether you run Drupal Entity Print or Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126736: Entity Print sensitive information disclosure to third-party servers

Q: Which products and versions are affected?

Drupal Entity Print <2.20.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print ECOSYSTEM:introduced=0,fixed=2.20.0.

Q: Is there a fix for CVE-2026-126736?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print: upgrade to 2.20.0 or later. Until then: Disable the "Enable Remote URLs" setting in the Dompdf print engine configuration to prevent external resources from being fetched during PDF generation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126736 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126736?

Check whether you run Drupal Entity Print or Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126736 · Severity: info · Published 2026-11-11

The Entity Print module for Drupal enables users to export web content to PDF and other formats. When generating PDFs that contain external resources (images or stylesheets from other websites), the module inadvertently sends users' session cookies and authentication credentials to those third-party servers, allowing attackers to hijack user accounts. Exploitation requires an attacker to control content with external resource references in a text format that permits such links.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126736 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126736 being exploited in the wild.
How severe is CVE-2026-126736?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Entity Print <2.20.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print ECOSYSTEM:introduced=0,fixed=2.20.0.
Is there a fix for CVE-2026-126736?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print: upgrade to 2.20.0 or later. Until then: Disable the "Enable Remote URLs" setting in the Dompdf print engine configuration to prevent external resources from being fetched during PDF generation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126736 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126736?: Check whether you run Drupal Entity Print or Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print: upgrade to 2.20.0 or later

Disable the "Enable Remote URLs" setting in the Dompdf print engine configuration to prevent external resources from being fetched during PDF generation.

Technical details

This is an information disclosure vulnerability in the Entity Print Drupal module's PDF generation functionality. When Dompdf processes a PDF containing third-party resources, the module sends HTTP requests with the user's session cookie and HTTP authentication credentials to external hosts, regardless of whether those hosts should receive such data. An attacker who can inject malicious external resource URLs into editable content (in a format like "Full HTML") can capture session tokens to impersonate victims.

Affected products

Drupal Entity Print <2.20.0

Identifiers

CVE-2026-126736
DRUPAL-CONTRIB-2026-327

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.