{"id":"CVE-2026-96375","aliases":["DRUPAL-CONTRIB-2026-176","EUVD-2026-107825","GHSA-cxrv-m5j5-pwvm"],"status":"published","title":"Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176","description":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00117,"percentile":0.01672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-09-23T16:50:15Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/cloud","fixed_in":["7.0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1"}]}]}],"products":[{"vendor":"cisco","product":"cloud"},{"vendor":"drupal","product":"cloud"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-176","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96375","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cxrv-m5j5-pwvm"},{"url":"https://git.drupalcode.org/project/cloud","tags":["web"]},{"url":"https://www.drupal.org/project/cloud","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96375.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96375","title":"Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176","description":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","status":"published","published":"2026-10-22T01:21:32.192Z","modified":"2026-10-22T14:44:38.627Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107825","description":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","status":"published","published":"2026-10-22T01:21:32Z","modified":"2026-10-22T14:44:38Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.198677Z"}],"ghsa":[{"id":"GHSA-cxrv-m5j5-pwvm","title":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle ...","description":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","status":"published","published":"2026-10-22T03:33:46Z","modified":"2026-10-22T15:32:43Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:14:15.712154Z"}],"nvd":[{"id":"CVE-2026-96375","description":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","status":"published","published":"2026-10-22T02:17:07.833Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-96375","title":"Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176","description":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","status":"published","published":"2026-10-22T01:21:32.192Z","modified":"2026-10-28T02:31:14.603792109Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"DRUPAL-CONTRIB-2026-176","description":"The Cloud module enables users to manage cloud infrastructure through Drupal.\n\nThe Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially allowing unauthorized access to the connected infrastructure.","status":"published","published":"2026-09-23T16:50:15Z","modified":"2026-09-23T19:15:04.975464235Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}