PatchClock

PHP security digest · 23 Sep 2026

The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates...

Unrated CVE-2026-96375

Package
drupal/cloud
Fixed in
7.0.1
Published
Wed 23 Sep 2026, 17:50 LisbonUpdated Mon 26 Oct 2026, 02:25 Lisbon

In plain words

The Cloud module's Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially gaining unauthorised access to the connected infrastructure.

Am I affected?

Look for drupal/cloud and its version in composer.lock, then check whether your project uses the Kubernetes or VMware integrations. The advisory lists 7.0.1 as fixed but gives no affected version range, so it does not establish which other versions are affected.

What to do

Check which version you have, then update to a fixed release for your branch (7.0.1):

composer show drupal/cloud | grep versions
composer update drupal/cloud

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Cloud module enables users to manage cloud infrastructure through Drupal.

The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially allowing unauthorized access to the connected infrastructure.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.