CVE-2026-13233 is a Server-Side Request Forgery (SSRF) vulnerability in the Drupal OpenAI Provider module. It affects versions from 0.0.0 through 1.1.1 and 1.2.0 through 1.2.2. The vulnerability allows an attacker with high privileges to induce the server to send crafted requests to internal or external systems. The CVSS vector indicates that the attack requires network access, high attack complexity, and high privileges, with no user interaction needed. The impact includes low confidentiality and integrity loss, with no availability impact. There is no vendor advisory or patch available at this time.

An attacker with high privileges on the affected Drupal OpenAI Provider module can exploit this SSRF vulnerability to make the server perform unintended requests. This may lead to limited confidentiality and integrity impacts, such as accessing internal resources or manipulating data indirectly. The vulnerability does not affect availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Drupal OpenAI Provider module to trusted administrators only and monitor for unusual request patterns. Avoid exposing the module to untrusted networks or users with elevated privileges.