Drupal Core EUVD-2026-43084

Exploitation requires an active authenticated session with at least low-privilege Drupal role access (PR:L per CVSS vector) - unauthenticated exploitation is not possible. High Attack Complexity (AC:H) indicates additional conditions must be met beyond authentication: the specific Drupal feature or content type that triggers the server-side request must be enabled and accessible to the attacker's role; this is not disclosed in the available data and must be confirmed via the full advisory at https://www.drupal.org/sa-core-2026-008. Impact is strictly limited to low confidentiality exposure - the attacker can probe and read responses from internal destinations but cannot modify data or cause service disruption (I:N, A:N). Sites that restrict low-privilege user access to content-authoring features and block outbound server HTTP requests to internal address ranges via network controls substantially reduce realistic exploitability despite the network attack vector.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained attack surface: High Attack Complexity (AC:H) implies specific preconditions beyond authentication alone, and Low Privilege Required (PR:L) rules out unauthenticated exploitation. The scope is unchanged (S:U) and impact is limited to Low Confidentiality with no Integrity or Availability consequence, consistent with SSRF that enables server-side probing but not direct code execution. The EPSS score of 0.13% at the 3rd percentile confirms low near-term exploitation probability, and the absence from CISA KEV means no confirmed active exploitation. There is no known POC. The primary real-world risk is in multi-tenant or hosting environments where a low-privilege content editor account could be used to probe internal infrastructure not otherwise accessible. This is not an emergency out-of-cycle patch but should be included in the next routine Drupal maintenance window.

An authenticated Drupal user with a low-privilege editorial or contributor role submits crafted input embedding an internal URL - such as http://169.254.169.254/latest/meta-data/ or http://internal-api.corp/admin - through a Drupal feature that performs server-side HTTP requests (such as feed aggregation, remote media fetching, or a similar subsystem). The Drupal server issues the request on the attacker's behalf and returns the response, exposing instance credentials or internal service data to the attacker. No public exploit code has been identified at the time of this analysis.