CVE-2026-13233 OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
Attackers can exploit SSRF in the Drupal OpenAI Provider module to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13233?
CVE-2026-13233 is a low-severity server-side request forgery vulnerability in Drupal OpenAI Provider, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.
Weakness: CWE-918
Which versions are affected by CVE-2026-13233?
It affects 1 product.
Linux distribution packages (1)
drupal/ai_provider_openai Packagist:https://packages.drupal.org/8 | All versions | 1.1.1, 1.2.2 |
Products include Openai Provider Project Openai Provider.
How do I fix CVE-2026-13233?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-13233 being exploited?
There is no known exploitation of CVE-2026-13233 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DRUPAL-CONTRIB-2026-053, GHSA-65px-3fq7-92h3.