CVE-2026-3216 Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

Medium 5.0 Published 25 Mar 2026 Updated 27 Mar 2026

Attackers can exploit a Server-Side Request Forgery flaw in the Drupal Canvas module to access internal resources or sensitive information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-3216?

CVE-2026-3216 is a medium-severity server-side request forgery vulnerability in Drupal Canvas, published on 25 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

Weakness: CWE-918

Which versions are affected by CVE-2026-3216?

It affects 1 product.

Linux distribution packages (1)

drupal/canvas Packagist:https://packages.drupal.org/8 All versions 1.1.1

Products include Drupal Canvas Project Drupal Canvas.

How do I fix CVE-2026-3216?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-3216 being exploited?

There is no known exploitation of CVE-2026-3216 in the wild and no public exploit code.

Sources

Also known as DRUPAL-CONTRIB-2026-017, GHSA-6qhv-qccp-876q.