CVE-2026-15080: Drupal module CSRF flaw; unrelated

CISO Take

This CVE is a Cross-Site Request Forgery in "Ray Enterprise Translation," a Drupal contrib module for content translation — not the Ray distributed-computing framework used in ML pipelines despite the name overlap and the feed's ml_ops tag. No CVSS score, EPSS percentile, or CISA KEV status is available, and there is no public exploit or Nuclei template, so exploitation likelihood cannot be quantified from current data. This has zero bearing on AI/ML inference, training, or agent infrastructure; it only matters if your organization runs this specific Drupal module for an unrelated CMS/web property. Action: security teams should verify via NVD/drupal.org whether they run Ray Enterprise Translation on Drupal, and if so, patch to the fixed releases noted in the vendor advisory (drupal.org/sa-contrib-2026-071) using standard CSRF-token validation checks; no action is needed for AI/ML stack owners.

Sources: NVD drupal.org

What is the risk?

Low priority for AI/ML security teams. The vulnerability class (CWE-352, CSRF) is well-understood and typically low-to-medium severity, generally requiring user interaction (a logged-in admin visiting a malicious page) to exploit. No CVSS vector, EPSS score, or KEV/SSVC data is published, and no public exploit or scanner template exists, so real-world exploitation pressure appears minimal at this time. Critically, this affects a Drupal CMS translation module, not any AI/ML component — the apparent match to "ray" (the ml_ops pip package) is a name collision, not a code relationship, so package-level risk scoring for AI infrastructure does not apply here.

How does the attack unfold?

Initial Access

Attacker lures an authenticated Drupal user with translation-module privileges to a malicious page containing a forged request.

Exploitation

Victim's browser submits the forged CSRF request to the Ray Enterprise Translation module, since the module fails to validate the request's origin/token.

Impact

Unauthorized action (e.g., content/setting change) is executed within the Drupal translation module under the victim's session, without their consent.

Initial Access

Attacker lures an authenticated Drupal user with translation-module privileges to a malicious page containing a forged request.

Exploitation

Victim's browser submits the forged CSRF request to the Ray Enterprise Translation module, since the module fails to validate the request's origin/token.

Impact

Unauthorized action (e.g., content/setting change) is executed within the Drupal translation module under the victim's session, without their consent.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C None

I Low

A None

What should I do?

1 step

If your organization uses the Drupal "Ray Enterprise Translation" module (versions 0.0.0-4.0.4, 4.1.0-4.1.4, or 11.0.0-11.0.4), upgrade to the patched release referenced in the vendor advisory at drupal.org/sa-contrib-2026-071. Standard CSRF hardening applies: ensure Drupal core's form/CSRF token validation is enabled and not bypassed by custom code, restrict admin session exposure, and educate privileged users about not following untrusted links while authenticated. No action is required for AI/ML infrastructure, since this module is unrelated to the Ray ML framework or any tracked AI package.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Plugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-15080?

This CVE is a Cross-Site Request Forgery in "Ray Enterprise Translation," a Drupal contrib module for content translation — not the Ray distributed-computing framework used in ML pipelines despite the name overlap and the feed's ml_ops tag. No CVSS score, EPSS percentile, or CISA KEV status is available, and there is no public exploit or Nuclei template, so exploitation likelihood cannot be quantified from current data. This has zero bearing on AI/ML inference, training, or agent infrastructure; it only matters if your organization runs this specific Drupal module for an unrelated CMS/web property. Action: security teams should verify via NVD/drupal.org whether they run Ray Enterprise Translation on Drupal, and if so, patch to the fixed releases noted in the vendor advisory (drupal.org/sa-contrib-2026-071) using standard CSRF-token validation checks; no action is needed for AI/ML stack owners.

Is CVE-2026-15080 actively exploited?

No confirmed active exploitation of CVE-2026-15080 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-15080?

If your organization uses the Drupal "Ray Enterprise Translation" module (versions 0.0.0-4.0.4, 4.1.0-4.1.4, or 11.0.0-11.0.4), upgrade to the patched release referenced in the vendor advisory at drupal.org/sa-contrib-2026-071. Standard CSRF hardening applies: ensure Drupal core's form/CSRF token validation is enabled and not bypassed by custom code, restrict admin session exposure, and educate privileged users about not following untrusted links while authenticated. No action is required for AI/ML infrastructure, since this module is unrelated to the Ray ML framework or any tracked AI package.

What is the CVSS score for CVE-2026-15080?

CVE-2026-15080 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.14%.

What are the technical details?

Original Advisory

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

Exploitation Scenario

An attacker crafts a malicious webpage or link containing a forged request targeting the Ray Enterprise Translation module's endpoints. If a Drupal site administrator or user with translation-management privileges is logged in and visits the attacker's page (e.g., via a phishing link), their browser silently submits the forged request, causing an unauthorized state change (such as altering translation content or settings) within the module — without the victim's knowledge or explicit consent. This is a generic web CMS attack pattern and does not involve any AI model, pipeline, or inference component.

Weaknesses (CWE)

CWE-352 Cross-Site Request Forgery (CSRF) CWE-352 Cross-Site Request Forgery (CSRF)

CWE-352 — Cross-Site Request Forgery (CSRF): The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
[Implementation] Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

Source: MITRE CWE corpus.