SB2026092436 - Multiple vulnerabilities in Cloud module for Drupal

Description

This security bulletin contains information about 2 vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2026-96376)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to the affected module does not sufficiently sanitize user-controlled Git branch and repository URL values. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Improper Certificate Validation (CVE-ID: CVE-2026-96375)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. A remote attacker able to intercept the connection can obtain secret tokens and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.drupal.org/sa-contrib-2026-177
• https://www.drupal.org/sa-contrib-2026-176