# CVE-2026-55807: Drupal Drupal core SSRF in Media module oEmbed discovery

Source: https://junglewise.ai/threats/cve-2026-55807-drupal-drupal-core-ssrf-in-media-module-oembed-discovery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55807 · Severity: info · CVSS 5.4 · Published 2026-07-10

Drupal is a popular content management system used to build and manage websites. A vulnerability in its Media module could allow an attacker to trick the website into making unauthorized requests to internal or external servers. This could lead to the exposure of sensitive internal information or be used to bypass network security controls.

Technologies: [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55807 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55807 being exploited in the wild.

**How severe is CVE-2026-55807?** Informational severity, with a CVSS score of 5.4, published 10 July 2026.

**Which products and versions are affected?** Drupal Core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.

**Is there a fix for CVE-2026-55807?** Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55807 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55807?** Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 10.5.12 or later

  ```sh
  composer require drupal/core:^10.5.12
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal core Media module's implementation of oEmbed. The oEmbed specification supports URL discovery, and the vulnerable code failed to sufficiently restrict the targets of these discovery requests. An attacker with sufficient privileges to provide or trigger oEmbed content can leverage this to force the Drupal server to make HTTP requests to arbitrary internal or external URLs. This can be used to scan internal networks or access metadata services. The fix introduces a new configuration setting, 'media_oembed_discovery_trusted_host_patterns', which requires administrators to explicitly whitelist trusted hosts for URL discovery.

## Affected products

- Drupal Drupal core <10.5.12, 10.6.x < 10.6.11, 11.0.x, 11.1.x, 11.2.x < 11.2.14, 11.3.x < 11.3.12

## Identifiers

- CVE-2026-55807
- DRUPAL-CORE-2026-008

## Timeline

- 2026-06-17: advisory: Drupal security advisory SA-CORE-2026-008 published
- 2026-06-17: patched: Security updates released for Drupal 10 and 11 branches
- 2026-07-10: disclosed: CVE-2026-55807 published to NVD

## References

- [https://www.drupal.org/project/drupal](https://www.drupal.org/project/drupal)
- [https://www.drupal.org/sa-core-2026-008](https://www.drupal.org/sa-core-2026-008)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)