CVE-2026-55807 is a Server-Side Request Forgery (SSRF) vulnerability in Drupal core. It affects versions from 0.0.0 up to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, and all versions in the 11.0.* and 11.1.* series. The vulnerability allows an attacker with low privileges and no user interaction to cause the server to make unintended HTTP requests. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality impact with no integrity or availability impact. No official remediation or patch information is currently available.

The vulnerability could allow an attacker to make the Drupal server perform HTTP requests to arbitrary domains, potentially exposing internal resources or information. The impact is limited to a low confidentiality loss with no integrity or availability impact. There are no known exploits in the wild, and the attack complexity is high, requiring specific conditions to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor the Drupal security advisories for updates. Until a patch is available, consider restricting outbound HTTP requests from the Drupal server as a temporary mitigation if feasible.