███████╗██╗ ██╗██████╗ ██████╗ ███╗ ███╗ █████╗ ██╗ ██╗███████╗ ██╔════╝██║ ██║██╔══██╗██╔═══██╗ ████╗ ████║██╔══██╗██║ ██╔╝██╔════╝ ███████╗██║ ██║██║ ██║██║ ██║ ██╔████╔██║███████║█████╔╝ █████╗ ╚════██║██║ ██║██║ ██║██║ ██║ ██║╚██╔╝██║██╔══██║██╔═██╗ ██╔══╝ ███████║╚██████╔╝██████╔╝╚██████╔╝ ██║ ╚═╝ ██║██║ ██║██║ ██╗███████╗ ╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝

guest@sudomake:~/research$ cat cve-2026-55806.txt

CVE-2026-55806

Drupal corerebuild.phpLess critical · 9/25

Cache poisoning & open redirect

rebuild.php didn’t check the Host header against trusted host patterns. Result: cache poisoning and redirects to attacker-controlled domains.

weakness: Host header injection
credit: Co-credited reporter
affected: 10.5.x < 10.5.1210.6.x < 10.6.1111.0.x / 11.1.x (EOL)11.2.x < 11.2.1411.3.x < 11.3.12
fixed in: 10.5.1210.6.1111.2.1411.3.12
advisory: SA-CORE-2026-007

timeline

2026-06-17patch released
2026-06-17advisory published

read the official advisory ↗