SA-CONTRIB-2026-017: Drupal Canvas SSRF + Info Disclosure — The Hidden Submodule Problem

SA-CONTRIB-2026-017 is a moderately critical Drupal Canvas advisory, but the real risk hinges on one question: is the hidden canvas_ai submodule enabled? If you do not know the answer, that is the problem. 🚨 Danger: SSRF + Information Disclosure CVE-2026-3216 enables server-side request forgery and information disclosure via the canvas_ai submodule. If you run Drupal Canvas below 1.1.1 with canvas_ai enabled, your server can be used to make arbitrary outbound requests. Severity Snapshot SA ID CVE Severity Affected Versions Patched Version Action SA-CONTRIB-2026-017 CVE-2026-3216 Moderately Critical < 1.1.1 1.1.1 Update immediately What Happened On February 25, 2026, Drupal published SA-CONTRIB-2026-017 for Drupal Canvas, covering server-side request forgery (SSRF) and information disclosure. The vulnerability sits in the canvas_ai submodule — a hidden submodule that is often enabled via recipes or deployment scripts without explicit awareness. flowchart TD A[Drupal Canvas installed] --