CVE-2026-55806: Drupal core open redirect and cache poisoning in rebuild.php

CVE-2026-55806 · Severity: info · CVSS 3.7 · Published 2026-07-10

Drupal, a popular website management platform, contains a security flaw in its maintenance script used for rebuilding site caches. An attacker can manipulate web requests to trick the system into redirecting users to malicious websites or corrupting the site's temporary data storage. This could be used in phishing campaigns to steal user credentials or to display unauthorized content to visitors.

Technologies: Drupal, drupal/core (Packagist). Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-55806 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55806 being exploited in the wild.
How severe is CVE-2026-55806?
Informational severity, with a CVSS score of 3.7, published 10 July 2026.
Which products and versions are affected?
Drupal <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.
Is there a fix for CVE-2026-55806?
Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55806 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55806?
Check whether you run Drupal or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • drupal/core (Packagist): upgrade to 10.5.12 or later
    composer require drupal/core:^10.5.12

Technical details

An open redirect and cache poisoning vulnerability exists in Drupal core's rebuild.php front controller. The script fails to properly validate the HTTP Host header against the configured list of trusted host patterns. A remote attacker can exploit this by sending a specially crafted request with a malicious Host header. This can lead to the application generating redirects to attacker-controlled domains or poisoning the internal cache with incorrect host information, potentially affecting subsequent legitimate user requests. Patches are available in Drupal versions 10.5.12, 10.6.11, 11.2.14, and 11.3.12.

Affected products

  • Drupal Drupal core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12

Identifiers

  • CVE-2026-55806
  • DRUPAL-CORE-2026-007

Timeline

  • 2026-06-17: advisory: Drupal security advisory SA-CORE-2026-007 published
  • 2026-07-10: disclosed: CVE-2026-55806 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.