"Ricochet was very impressive with their knowledge, abilities and professionalism. We never ran into a technological roadblock or problem that couldn't be solved. They were able to offer new, cutting-edge solutions around every corner, and they were fantastic about staying in communication. It seemed like we were always able to get ahold of someone, whether it was Tuesday at 1am or Saturday at 7am, someone was quick to respond and help address an emergency or even a simple inquiry. Truly professional service, and quality work.
—Jacob Sowinski, Blue Canvas

Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

Wed, 2026-02-25 10:51 — Anonymous (not verified)

Project: Drupal CanvasDate: 2026-February-25Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Server-side request forgery, Information disclosureAffected versions: <1.1.1CVE IDs: CVE-2026-3216Description: This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers.
The project has a hidden sub-module, Drupal Canvas AI, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed.
The module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload.
It is mitigated by the fact that an attacker must have a role with the permission "use Drupal Canvas AI".
How the Canvas AI sub-module gets enabled: As a hidden submodule, canvas_ai is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush).Solution: Install the latest version:

If you use the Drupal Canvas module, upgrade to Drupal Canvas 1.1.1 .

Sites witthout the hidden submodule enabled are not vulnerable. The module is hidden from the UI module list, but admins can verify its status via the command line: drush config:get core.extension | grep canvas_aiReported By:

Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Bálint Kléri (balintbrews)
Ignacio Sánchez Holgueras (isholgueras)
Drew Webber (mcdruid) of the Drupal Security Team
Narendra Singh Rathore (narendrar)
Christian López Espínola (penyaskito)
Tim Plunkett (tim.plunkett)

Coordinated By:

Greg Knaddison (greggles) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-017

Search form

Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017