SA-CONTRIB-2026-177: Critical severity drupal/cloud vulnerability
The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary operating-system commands as the web-server user. This vulnerability is mitigated by the fact that the Kubernetes submodule must be enabled and configured, Git must be available on the server, and an attacker must have permission to add or edit cloud server templates. Exploiting the clone path additionally requires the "launch cloud server template" permission, or the "launch approved cloud server template" permission when using the approved-template flow.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/cloudto a version that resolves this vulnerability.Fixed in 7.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires the Kubernetes submodule to be enabled and configured, and Git to be available on the server. Deployments without that integration configured do not meet the stated exploitation prerequisites.
What access does an attacker need to exploit it?
An attacker must have permission to add or edit cloud server templates so they can control Git branch or repository URL values. For exploitation through the clone path, they also need permission to launch cloud server templates, or to launch approved cloud server templates when using the approved-template flow.
What level of access could successful exploitation provide?
Successful exploitation allows arbitrary operating-system command execution as the web-server user. The resulting impact is limited to the privileges available to that web-server account.