EUVD-2026-43057
GHSA-65px-3fq7-92h3
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Admin credentials required (PR:H) and complex preconditions (AC:H); SSRF yields only partial internal resource access with no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
6DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.
AnalysisAI
Server-Side Request Forgery in the Drupal OpenAI Provider module enables authenticated administrators to force the server to issue HTTP requests to attacker-controlled destinations, potentially reaching internal network resources beyond the intended API boundary. Affected versions span 0.0.0 through 1.1.1 and 1.2.0 through 1.2.2; a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-053. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with Drupal administrator-level privileges (PR:H per CVSS vector), meaning the attacker must either already hold admin credentials or have compromised an admin account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available risk signals align at low severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Drupal administrator navigates to the OpenAI Provider module configuration and submits a crafted URL - for example, an internal cloud metadata endpoint or an intranet service address - as a parameter the module passes to its HTTP client. The Drupal server fetches the target URL server-side, potentially returning internal response data visible in the admin UI or logs. … |
| Remediation | Update the Drupal OpenAI Provider module to version 1.1.1 or 1.2.2, whichever corresponds to the installed branch, per vendor advisory SA-CONTRIB-2026-053 at https://www.drupal.org/sa-contrib-2026-053. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today