SA-CONTRIB-2026-276: Critical severity composer/drupal/cacheflush vulnerability
Published Oct 28, 2026
·Updated
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Credit
Ivo Van Geertruyen (mr.baileys)(the Drupal Security Team)
Affected Software
1 affected component
composer/drupal/cacheflush
Event History
Oct 28, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Is there a fix available for the known security issue?
No fix is identified in the advisory; it states that the known security issue has not been fixed by the maintainer.
2
What should organizations using this project do?
The project is unsupported for security reasons. Organizations should assess their use of composer/drupal/cacheflush and plan to remove, replace, or otherwise stop relying on the unsupported project.