Is CVE-2026-55807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55807 being exploited in the wild.

How severe is CVE-2026-55807?

Informational severity, with a CVSS score of 5.4, published 10 July 2026.

Which products and versions are affected?

Drupal Core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.

Is there a fix for CVE-2026-55807?

Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55807 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55807?

Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55807: Drupal Drupal core SSRF in Media module oEmbed discovery

Q: Which products and versions are affected?

Drupal Core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.

Q: Is there a fix for CVE-2026-55807?

Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55807 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55807?

Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55807 · Severity: info · CVSS 5.4 · Published 2026-07-10

Drupal is a popular content management system used to build and manage websites. A vulnerability in its Media module could allow an attacker to trick the website into making unauthorized requests to internal or external servers. This could lead to the exposure of sensitive internal information or be used to bypass network security controls.

Technologies: Drupal Core, drupal/core (Packagist). Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-55807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55807 being exploited in the wild.
How severe is CVE-2026-55807?: Informational severity, with a CVSS score of 5.4, published 10 July 2026.
Which products and versions are affected?: Drupal Core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.
Is there a fix for CVE-2026-55807?: Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55807 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55807?: Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

drupal/core (Packagist): upgrade to 10.5.12 or later
```
composer require drupal/core:^10.5.12
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal core Media module's implementation of oEmbed. The oEmbed specification supports URL discovery, and the vulnerable code failed to sufficiently restrict the targets of these discovery requests. An attacker with sufficient privileges to provide or trigger oEmbed content can leverage this to force the Drupal server to make HTTP requests to arbitrary internal or external URLs. This can be used to scan internal networks or access metadata services. The fix introduces a new configuration setting, 'media_oembed_discovery_trusted_host_patterns', which requires administrators to explicitly whitelist trusted hosts for URL discovery.

Affected products

Drupal Drupal core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12

Identifiers

CVE-2026-55807
DRUPAL-CORE-2026-008

Timeline

2026-06-17: advisory: Drupal security advisory SA-CORE-2026-008 published
2026-06-17: patched: Security updates released for Drupal 10 and 11 branches
2026-07-10: disclosed: CVE-2026-55807 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.