CVE-2026-96375 - Vulnerability Details - OpenCVE

ReportizFlow

Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Drupal	Cloud

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-176

History

Thu, 22 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

Thu, 22 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal cloud
Vendors & Products		Drupal Drupal cloud

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
Title		Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Weaknesses		CWE-295
References		https://www.drupal.org/sa-contrib-2026-176

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-22T01:21:32.192Z

Updated: 2026-10-22T14:44:38.627Z

Reserved: 2026-09-23T01:32:48.996Z

Link: CVE-2026-96375

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:07.833

Modified: 2026-10-22T16:54:17.390

Link: CVE-2026-96375

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96375", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-09-23T01:32:48.996Z", "datePublished": "2026-10-22T01:21:32.192Z", "dateUpdated": "2026-10-22T14:44:38.627Z"}, "containers": {"cna": {"title": "Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176", "datePublic": "2026-09-23T16:50:15.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-176"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/cloud", "product": "Cloud", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/cloud", "versions": [{"lessThan": "7.0.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1."}], "credits": [{"lang": "en", "type": "finder", "value": "Kalle Kipin\u00c3\u00a4 (kekkis)"}, {"lang": "en", "type": "remediation developer", "value": "AI Yas (ai_yas)"}, {"lang": "en", "type": "remediation developer", "value": "baldwinlouie"}, {"lang": "en", "type": "remediation developer", "value": "Yas Naoi (yas)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:21:32.192Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T14:38:52.182653Z", "id": "CVE-2026-96375", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T14:44:38.627Z"}}]}}