SA-CORE-2026-007: Critical severity Drupal Drupal vulnerability
Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.3.12Fixed in 11.2.14Fixed in 10.6.11Fixed in 10.5.12 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 11.3.12 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 11.2.14 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 10.6.11 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 10.5.12 - Configuration
Configure trusted_host_patterns in settings.php to include only the valid hostnames for your site so the Host header is validated against a strict allowlist.
Drupal core trusted_host_patterns = patterns matching only your legitimate hostnames - Compensating control
Restrict access to the rebuild.php front controller to trusted IPs or internal networks (via web server ACLs or firewall rules) to prevent external attackers from triggering the script while the Host header issue is being remediated.
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-007?
The severity of SA-CORE-2026-007 is rated as critical with a score of 9.
How do I fix SA-CORE-2026-007?
To fix SA-CORE-2026-007, update to the latest version of Drupal where the vulnerability is patched.
What are the risks associated with SA-CORE-2026-007?
The risks include unauthorized access to the rebuild.php script, potentially allowing an attacker to manipulate the site caches.
What version of Drupal is affected by SA-CORE-2026-007?
SA-CORE-2026-007 affects all versions of Drupal that include the vulnerable rebuild.php front controller.
When was SA-CORE-2026-007 published?
SA-CORE-2026-007 was published on June 17, 2026.