CVE-2026-13233: SSRF via unvalidated API endpoint

CISO Take

This is a Server-Side Request Forgery in the OpenAI Provider module for Drupal, which wires Drupal sites into OpenAI-compatible APIs for content generation and chatbot features, and fails to validate the destination of outbound API requests. There is no CVSS score, no EPSS percentile, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks like a freshly-disclosed contrib module bug rather than something under active exploitation — but SSRF against server-side AI integrations is a well-worn path to cloud credential theft via instance metadata endpoints and internal network reconnaissance once someone builds a working exploit. Blast radius is hard to size precisely (downstream dependents unknown, package risk score 0/100 reflecting missing telemetry rather than confirmed low risk), but any Drupal site running this module with editor/admin roles that aren't fully trusted is exposed. Patch to a version above 1.1.1 or above 1.2.2 per Drupal advisory SA-contrib-2026-053 now; in the meantime restrict which roles can edit the module's API endpoint configuration and egress-filter the web server so it cannot reach cloud metadata IPs (169.254.169.254) or internal-only services.

Sources: NVD drupal.org

What is the risk?

Unscored (no CVSS/EPSS) but should be treated as medium risk pending patching. SSRF (CWE-918) in a server-side component that makes outbound HTTP calls on behalf of the application is a proven technique for reaching cloud metadata services and internal-only endpoints, which can escalate to credential theft or lateral movement even without RCE. Exploitability is gated by whether an attacker can influence the configured API endpoint (likely requires an editor/admin role with access to the module configuration, or a chained CSRF), which caps sophistication at 'moderate' rather than trivial. Absence from CISA KEV and lack of a public PoC lower near-term urgency, but the affected version ranges (0.0.0–1.1.1 and 1.2.0–1.2.2) suggest most current installs are vulnerable until patched.

How does the attack unfold?

Initial Access

Attacker with editor/admin access (or via CSRF) modifies the OpenAI Provider module's configured API endpoint to an internal or attacker-controlled URL.

AML.T0049

Exploitation

The module issues an outbound server-side HTTP request to the malicious endpoint without validating that it is a legitimate OpenAI/compatible API address.

Impact

The request reaches an internal service or cloud metadata endpoint, potentially exposing credentials or internal data back to the attacker via logs or response handling.

AML.T0075

Initial Access

Attacker with editor/admin access (or via CSRF) modifies the OpenAI Provider module's configured API endpoint to an internal or attacker-controlled URL.

AML.T0049

Exploitation

The module issues an outbound server-side HTTP request to the malicious endpoint without validating that it is a legitimate OpenAI/compatible API address.

Impact

The request reaches an internal service or cloud metadata endpoint, potentially exposing credentials or internal data back to the attacker via logs or response handling.

AML.T0075

How severe is it?

CVSS 3.1

3.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR High

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

Upgrade the OpenAI Provider module past 1.1.1 (for the 1.1.x line) or past 1.2.2 (for the 1.2.x line) per Drupal advisory SA-contrib-2026-053. Until patched: restrict which roles/permissions can edit the module's API endpoint/base URL configuration; enforce network egress controls on the web server so it cannot reach RFC1918 ranges or cloud metadata IPs (169.254.169.254, metadata.google.internal); if using a cloud provider, require IMDSv2 or equivalent metadata-service hardening. Detection: monitor outbound HTTP logs from the Drupal host for requests to internal IP ranges or metadata endpoints originating from the module's HTTP client, and audit recent changes to the module's configuration entity.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Plugin API AML.T0049 - Exploit Public-Facing Application AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-13233?

This is a Server-Side Request Forgery in the OpenAI Provider module for Drupal, which wires Drupal sites into OpenAI-compatible APIs for content generation and chatbot features, and fails to validate the destination of outbound API requests. There is no CVSS score, no EPSS percentile, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks like a freshly-disclosed contrib module bug rather than something under active exploitation — but SSRF against server-side AI integrations is a well-worn path to cloud credential theft via instance metadata endpoints and internal network reconnaissance once someone builds a working exploit. Blast radius is hard to size precisely (downstream dependents unknown, package risk score 0/100 reflecting missing telemetry rather than confirmed low risk), but any Drupal site running this module with editor/admin roles that aren't fully trusted is exposed. Patch to a version above 1.1.1 or above 1.2.2 per Drupal advisory SA-contrib-2026-053 now; in the meantime restrict which roles can edit the module's API endpoint configuration and egress-filter the web server so it cannot reach cloud metadata IPs (169.254.169.254) or internal-only services.

Is CVE-2026-13233 actively exploited?

No confirmed active exploitation of CVE-2026-13233 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13233?

Upgrade the OpenAI Provider module past 1.1.1 (for the 1.1.x line) or past 1.2.2 (for the 1.2.x line) per Drupal advisory SA-contrib-2026-053. Until patched: restrict which roles/permissions can edit the module's API endpoint/base URL configuration; enforce network egress controls on the web server so it cannot reach RFC1918 ranges or cloud metadata IPs (169.254.169.254, metadata.google.internal); if using a cloud provider, require IMDSv2 or equivalent metadata-service hardening. Detection: monitor outbound HTTP logs from the Drupal host for requests to internal IP ranges or metadata endpoints originating from the module's HTTP client, and audit recent changes to the module's configuration entity.

What systems are affected by CVE-2026-13233?

This vulnerability affects the following AI/ML architecture patterns: CMS-embedded LLM integrations, server-side API proxies, plugin-based AI features.

What is the CVSS score for CVE-2026-13233?

CVE-2026-13233 has a CVSS v3.1 base score of 3.3 (LOW). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

CMS-embedded LLM integrationsserver-side API proxiesplugin-based AI features

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

Exploitation Scenario

An attacker who has (or obtains, e.g. via a compromised low-privilege editor account or a CSRF against an admin) access to the OpenAI Provider module's configuration sets the API endpoint/base URL field to an internal address such as the cloud instance metadata service (169.254.169.254) or an internal admin panel. When the module fires its next outbound API call — for example when a content editor triggers an AI-assisted content generation action — the Drupal server issues the HTTP request to the attacker-chosen destination instead of OpenAI, and the response (potentially containing cloud IAM credentials or internal service data) may be exposed back through logs, error messages, or the module's response handling.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.