CVE-2026-55806

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

We have discovered 180,897 live websites that are affected by CVE-2026-55806.

Run a Free Instant Scan



Affected Software

Product  Drupal
Category Content Management System
Vulnerable Domains180,897 live websites (88% of Drupal install base)
Vulnerable Versions
  • from 0 through 10.5.12
  • from 10.6 through 10.6.11
  • from 11.2 through 11.2.14
  • from 11.3 through 11.3.12
Vulnerable Versions Count311 versions ( 91% of all versions)


Common Weakness Enumeration

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')



Details

  • Published - Jul 10, 2026
  • Updated - Jul 13, 2026

Credits

  • Melih Acikoz (finder)
  • Michael Winser (michaelwinser) (finder)
  • Willem Drupal enthousiast (willempje2) (finder)
  • Lee Rowlands (larowlan) (remediation developer)
  • catch (catch) (coordinator)
  • cilefen (cilefen) (coordinator)
  • Greg Knaddison (greggles) (coordinator)
  • Lee Rowlands (larowlan) (coordinator)
  • Dave Long (longwave) (coordinator)
  • James Gilliland (neclimdul) (coordinator)
  • Juraj Nemec (poker10) (coordinator)
  • Jess (xjm) (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-55806
United States56,478 websites


Germany16,585 websites
France13,599 websites
Russia11,735 websites
Belgium7,368 websites
GB6,445 websites
Italy5,566 websites
Netherlands5,159 websites
Spain4,600 websites
Canada4,585 websites

Website Distribution by TLD

Number of websites using CVE-2026-55806
.com46,605 websites
.org16,863 websites
.de10,375 websites
.ru9,428 websites
.edu8,005 websites
.fr7,178 websites
.be6,877 websites
.nl4,423 websites
.it4,207 websites
.net3,884 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-55806

Top websites that are affected by CVE-2026-55806. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.**.uk GB***
***.gov United States***
****.fr France***
***.gov United States***
***.gov United States*,***
*******.gov United States*,***
********.***.gov United States*,***
***.gov United States*,***
******.com United States*,***
***.*******.edu United States*,***
See full domain list

FAQ

CVE-2026-55806 is URL Redirection to Untrusted Site ('Open Redirect') in Drupal
A total of 180,897 websites have been identified as vulnerable to CVE-2026-55806, based on global website indexing conducted by WebTechSurvey.
The Drupal is affected by the CVE-2026-55806 vulnerability.
Drupal versions up to 11.3.12 are vulnerable to CVE-2026-55806.
CVE-2026-55806 is resolved in version 11.3.12 of Drupal.