CVE-2026-126738: Composer/drupal/mollie vulnerability

Q: Which deployments are exposed to this issue?

The issue is mitigated unless the mollie_webform submodule is enabled. Deployments using that submodule should be treated as potentially exposed because the Mollie secret token can be disclosed in some cases.

Q: What should be reviewed while a fix is being applied?

Review whether mollie_webform is enabled and assess whether the Mollie secret token may have been exposed. If exposure is suspected, rotate the affected Mollie secret token.

Published Nov 11, 2026

Updated

This module enables you to accept online payments on your website using Mollie.

In some cases the Mollie secret token can be exposed.

This vulnerability is mitigated by the fact that the molliewebform submodule must be enabled.

Affected Software

1 affected componentFixes available

composer/drupal/mollie<2.3.2

2.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/mollie to a version that resolves this vulnerability.
Fixed in 2.3.2
Configuration
Enable the mollie_webform submodule to mitigate exposure of the Mollie secret token.
Mollie module mollie_webform submodule = enabled

Event History

Nov 11, 2026

Advisory Published

via OSV·05:56 PM

Data Sourced

via OSV·05:56 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue is mitigated unless the mollie_webform submodule is enabled. Deployments using that submodule should be treated as potentially exposed because the Mollie secret token can be disclosed in some cases.

What should be reviewed while a fix is being applied?

Review whether mollie_webform is enabled and assess whether the Mollie secret token may have been exposed. If exposure is suspected, rotate the affected Mollie secret token.