CVE-2026-3216

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3216", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-02-25T16:59:32.261Z", "datePublished": "2026-03-25T15:24:17.937Z", "dateUpdated": "2026-03-27T13:58:20.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-25T15:24:17.937Z"}, "title": "Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017", "datePublic": "2026-02-25T18:51:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "affected": [{"vendor": "Drupal", "product": "Drupal Canvas", "collectionURL": "https://www.drupal.org/project/canvas", "repo": "https://git.drupalcode.org/project/canvas", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.<p>This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.</p>"}]}], "references": [{"url": "https://www.drupal.org/sa-contrib-2026-017"}], "credits": [{"lang": "en", "value": "Drew Webber (mcdruid)", "type": "finder"}, {"lang": "en", "value": "B\u00c3\u00a1lint Kl\u00c3\u00a9ri (balintbrews)", "type": "remediation developer"}, {"lang": "en", "value": "Ignacio S\u00c3\u00a1nchez Holgueras (isholgueras)", "type": "remediation developer"}, {"lang": "en", "value": "Drew Webber (mcdruid)", "type": "remediation developer"}, {"lang": "en", "value": "Narendra Singh Rathore (narendrar)", "type": "remediation developer"}, {"lang": "en", "value": "Christian L\u00c3\u00b3pez Esp\u00c3\u00adnola (penyaskito)", "type": "remediation developer"}, {"lang": "en", "value": "Tim Plunkett (tim.plunkett)", "type": "remediation developer"}, {"lang": "en", "value": "Greg Knaddison (greggles)", "type": "coordinator"}, {"lang": "en", "value": "Drew Webber (mcdruid)", "type": "coordinator"}, {"lang": "en", "value": "Juraj Nemec (poker10)", "type": "coordinator"}, {"lang": "en", "value": "Jess (xjm)", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T20:13:57.967836Z", "id": "CVE-2026-3216", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T13:58:20.679Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-3216", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:13:57.967836Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:14:14.588Z"}}], "cna": {"title": "Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "B\u00c3\u00a1lint Kl\u00c3\u00a9ri (balintbrews)"}, {"lang": "en", "type": "remediation developer", "value": "Ignacio S\u00c3\u00a1nchez Holgueras (isholgueras)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Narendra Singh Rathore (narendrar)"}, {"lang": "en", "type": "remediation developer", "value": "Christian L\u00c3\u00b3pez Esp\u00c3\u00adnola (penyaskito)"}, {"lang": "en", "type": "remediation developer", "value": "Tim Plunkett (tim.plunkett)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/canvas", "vendor": "Drupal", "product": "Drupal Canvas", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.1.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/canvas", "defaultStatus": "unaffected"}], "datePublic": "2026-02-25T18:51:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-017"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.", "supportingMedia": [{"type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.<p>This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-25T15:24:17.937Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3216", "state": "PUBLISHED", "dateUpdated": "2026-03-26T14:41:26.753Z", "dateReserved": "2026-02-25T16:59:32.261Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-03-25T15:24:17.937Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/canvas", "defaultStatus": "unaffected", "product": "Drupal Canvas", "repo": "https://git.drupalcode.org/project/canvas", "vendor": "Drupal", "versions": [{"lessThan": "1.1.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal_canvas_project:drupal_canvas:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "46DDBEDE-7D73-4AC5-B9D4-17EA870E0591", "versionEndExcluding": "1.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en Drupal Drupal Canvas permite la falsificaci\u00f3n de petici\u00f3n del lado del servidor. Este problema afecta a Drupal Canvas: desde 0.0.0 anterior a 1.1.1."}], "id": "CVE-2026-3216", "lastModified": "2026-06-17T10:43:13.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3216", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T20:13:57.967836Z", "version": "2.0.3"}}]}, "published": "2026-03-25T16:16:22.777", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-contrib-2026-017"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,1.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Drupal Canvas", "source": "cna", "vendor": "Drupal"}, "product": "drupal_canvas", "vendor": "drupal"}], "analysis": {"en": {"generated_at": "2026-04-01T05:47:02.468690+00:00", "value": {"mitigation_remediation": ["Upgrade Drupal Canvas to version\u202f1.1.1 or later.", "If an upgrade is not immediately feasible, restrict outbound network traffic from the web server to known trusted destinations using a firewall or network ACL.", "Monitor the server for unexpected outbound requests and review logs for signs of SSRF activity."], "summary": {"action": "Immediate Patch", "impact": "Server\u2011Side Request Forgery and potential information disclosure"}, "threat_synthesis": {"affected_systems": "The issue affects all Drupal Canvas installations with a version number less than 1.1.1, including the initial release 0.0.0. The affected component is the Drupal Canvas module, identified by the CPE string cpe:2.3:a:drupal_canvas_project:drupal_canvas:*:*:*:*:*:drupal:*:*. The vendor responsible for this product is Drupal.", "description_and_impact": "Drupal Canvas contains a server\u2011side request forgery vulnerability that allows an attacker to instruct the server to make requests to arbitrary URLs. This flaw enables probing of internal network services or accessing resources the server can reach, potentially revealing sensitive data or aiding further attacks. The weakness is classified as CWE\u2011918.", "risk_and_exploitability": "The CVSS v3.1 score assigned to this vulnerability is 5.0, indicating a moderate risk. The EPSS score is below 1\u202f%, suggesting a low prevalence of exploit activity in the wild. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, meaning no widely known exploits are documented. Nevertheless, because the flaw permits arbitrary outbound requests, an attacker who can reach the affected server can exfiltrate information or pivot to other internal assets. The exploit requires network connectivity to the target server and can be performed without local privileges, making it potentially feasible for remote attackers."}}}}, "created": "2026-03-25T21:31:01.368933+00:00", "updated": "2026-04-02T07:59:10.845497+00:00", "vendors": ["drupal", "drupal$PRODUCT$drupal_canvas"]}