Executive brief
Drupal is a popular content management system used to build and manage websites. A vulnerability in its Media module could allow an attacker to trick the website into making unauthorized requests to internal or external servers. This could lead to the exposure of sensitive internal information or be used to bypass network security controls.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal core Media module's implementation of oEmbed. The oEmbed specification supports URL discovery, and the vulnerable code failed to sufficiently restrict the targets of these discovery requests. An attacker with sufficient privileges to provide or trigger oEmbed content can leverage this to force the Drupal server to make HTTP requests to arbitrary internal or external URLs. This can be used to scan internal networks or access metadata services. The fix introduces a new configuration setting, 'media_oembed_discovery_trusted_host_patterns', which requires administrators to explicitly whitelist trusted hosts for URL discovery.
Affected products
- Drupal Drupal core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12
Timeline
- 2026-06-17: advisory: Drupal security advisory SA-CORE-2026-008 published
- 2026-06-17: patched: Security updates released for Drupal 10 and 11 branches
- 2026-07-10: disclosed: CVE-2026-55807 published to NVD