Server-Side Request Forgery Vulnerability in Drupal Canvas
CVE-2026-3216

4.3MEDIUM

Key Information:

Vendor

Drupal
Status
Drupal Canvas
Vendor
CVE Published:
25 March 2026

What is CVE-2026-3216?

A Server-Side Request Forgery (SSRF) vulnerability exists in Drupal Canvas that allows attackers to send unauthorized requests from the server. This flaw is present in versions prior to 1.1.1, making it critical for users to upgrade to avoid potential exploitation. Attackers could leverage this vulnerability to manipulate server requests, leading to information disclosure or other harmful actions. It is essential for site administrators to review their Drupal Canvas setups and implement the necessary updates to maintain secure operations.

Affected Version(s)

Drupal Canvas 0.0.0 < 1.1.1

References

https://www.drupal.org/sa-contrib-2026-017

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Bålint KlÊri (balintbrews)
Ignacio SÃ¥nchez Holgueras (isholgueras)
Drew Webber (mcdruid)
Narendra Singh Rathore (narendrar)
Christian López Espínola (penyaskito)
Tim Plunkett (tim.plunkett)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Jess (xjm)
.