CVE-2026-96376

Name of the Vulnerable Software and Affected Versions Drupal Cloud versions 0.0.0 through 7.0.1

Description An OS Command Injection issue exists in the Cloud module, which allows users to manage cloud resources. The module fails to sufficiently sanitize the Git branch and repository URL values before passing them to shell commands within the Kubernetes integration. This allows an attacker to execute arbitrary operating-system commands as the web-server user. Exploitation requires the Kubernetes submodule to be enabled and configured, Git to be installed on the server, and the attacker to possess permissions to add or edit cloud server templates. Additionally, exploiting the clone path requires the "launch cloud server template" or "launch approved cloud server template" permission.

Recommendations Update Drupal Cloud to a version later than 7.0.1. Restrict permissions to add or edit cloud server templates to trusted users only. Disable the Kubernetes submodule if it is not required for business operations.