CVE-2026-13233

LowCVSS 3.3

Published: 10/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows an attacker to send requests from the server to internal network resources. The issue affects versions from 0.0.0 to 1.1.1 and from 1.2.0 to 1.2.2.

Risk Assessment

An attacker can exploit this flaw to scan internal networks, access sensitive data, or launch attacks against other internal systems.

Recommendation

Immediately update the OpenAI Provider module to version 1.2.3 or later, which includes a fix for the SSRF vulnerability.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.