CVE-2026-55806: Drupal Core Cache Poisoning Vulnerability in rebuild.php
Summary
CVE-2026-55806: Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. Affects drupal/core across 6 version ranges.
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-55806 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and a large ecosystem of modules and themes. However, like any software, it can have vulnerabilities. The specific issue at hand involves the 'rebuild.php' front controller, which is designed to clear caches and rebuild the container when the site is in an unexpected state. This functionality is crucial for maintaining site performance and reliability.
Vulnerability Detail
The vulnerability arises from the 'rebuild.php' script not properly validating the Host header against a list of trusted host patterns. This oversight can lead to cache poisoning, where an attacker could manipulate cached data, or redirect users to a malicious domain. The potential ramifications include unauthorized access to sensitive information, disruption of service, and exploitation of the site for phishing or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.5.1210.5.12composer require drupal/core:10.5.12 -
>= 10.6.0, < 10.6.1110.6.11composer require drupal/core:10.6.11 -
>= 11.0.0, < 11.1.011.1.0composer require drupal/core:11.1.0 -
>= 11.1.0, < 11.2.011.2.0composer require drupal/core:11.2.0 -
>= 11.2.0, < 11.2.1411.2.14composer require drupal/core:11.2.14 -
>= 11.3.0, < 11.3.1211.3.12composer require drupal/core:11.3.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the 'rebuild.php' script by implementing server-level access controls, such as using .htaccess rules or firewall settings to limit access to trusted IP addresses only. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
In summary, CVE-2026-55806 is a significant vulnerability in Drupal core that can lead to cache poisoning and redirection risks. It is crucial to update to the latest patched versions to safeguard your site. Implementing temporary workarounds can help, but they should not replace a proper update.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2026-55806 is a vulnerability in Drupal core that affects the 'rebuild.php' script, allowing for potential cache poisoning and redirection to attacker-controlled domains.
If your site is running a version of Drupal core that is below 10.5.12, between 10.6.0 and 10.6.11, between 11.2.0 and 11.2.14, or between 11.3.0 and 11.3.12, it is vulnerable. You can also check using Vulert's playground at Vulert Scanner.
Failing to address this vulnerability could lead to cache poisoning, unauthorized access to sensitive data, and potential exploitation of your site for malicious purposes.
While the best solution is to update to a patched version, you can temporarily restrict access to 'rebuild.php' using server-level controls as a workaround.
Regularly check for updates and vulnerabilities, ideally on a weekly basis, to ensure your site remains secure. Tools like Vulert can help monitor vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
