CVE-2026-55806 Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Attackers can redirect users to untrusted sites via open redirect, potentially enabling phishing or content spoofing in Drupal core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55806?
CVE-2026-55806 is a medium-severity vulnerability in Drupal Drupal, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
Weakness: CWE-601
Which versions are affected by CVE-2026-55806?
2 open source packages ship an affected version, including drupal and drupal/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal Bitnami | All versions | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
drupal/core Packagist | All versions | 10.5.12, 10.6.11, 11.2.14, 11.3.12, 11.1.0, 11.2.0 |
Products include Drupal Drupal.
How do I fix CVE-2026-55806?
Upgrade drupal to a fixed version for your release line: 10.5.12, 10.6.11, 11.2.14 or 11.3.12.
Is CVE-2026-55806 being exploited?
There is no known exploitation of CVE-2026-55806 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2026-55806, DRUPAL-CORE-2026-007, GHSA-vwxh-w8pq-6q99, MINI-7fp5-9h99-9w24, MINI-w9j4-h772-v888.