CVE-2026-55804 Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Drupal core allows object injection via gadget chains, potentially enabling remote code execution for attackers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55804?
CVE-2026-55804 is a medium-severity unsafe deserialization vulnerability in Drupal Drupal, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
Weakness: CWE-915
Which versions are affected by CVE-2026-55804?
2 open source packages ship an affected version, including drupal and drupal/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal Bitnami | All versions | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
drupal/core Packagist | All versions | 10.5.12, 10.6.11, 11.2.14, 11.3.12, 11.1.0, 11.2.0 |
Products include Drupal Drupal.
How do I fix CVE-2026-55804?
Upgrade drupal to a fixed version for your release line: 10.5.12, 10.6.11, 11.2.14 or 11.3.12.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-55804 being exploited?
There is no known exploitation of CVE-2026-55804 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2026-55804, DRUPAL-CORE-2026-006, GHSA-x7hc-r9m3-67vr, MINI-j9q2-jgfm-p5cq, MINI-jj83-w49v-8697.