Cloud security updates, in plain English

Cloud

on drupal.org · 1 security update explained here

This module lets users manage their external server infrastructure directly from the website.

Below is every security update for Cloud that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Cloud

Critical · no install count published · 2 security fixes · Week of 23 September 2026

2 security fixes in one update. Cloud fixed 2 separate security bugs this week: 2 remote code execution. One update covers all of them. The most serious, SA-CONTRIB-2026-177, is explained here and the full list is at the end of the card.

An administrator account could run dangerous operating system commands on the web server by entering malicious web addresses. They could read any file on the server and change the core website code. They could not do this without the access right to add or edit server templates.

Who could do thisOnly someone with an administrator login.
Does it apply to youThis applies if the Kubernetes feature is turned on and the attacker has the access right to launch server templates.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate Cloud to 7.0.1.

For developers: what the fix changed

This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-177, the most serious of them.

It is unclear where the exact sanitisation occurs in the module's code, but the fix appears to rely on updating the `cloud_orchestrator` Docker image version to 7.0.1 in the Kubernetes deployment configuration files.

The fix is not clearly separable from the other changes in this release, so treat the summary above as a pointer rather than a finding.

Also in this release The release also adds new AWS region locations, updates type hints for PHP 8.4 compatibility, and removes 'default_argument_skip_url' from various view configurations.

7.0.0 to 7.0.1 25 commits, 772 files including 77 tests.

.gitlab-ci.yml +6 −4
README.md +3 −3
cloud.doxyfile +1 −1
cloud.info.yml +1 −1
cloud.install +31 −4
cloud.module +5 −5
config/install/field.storage.cloud_config.field_self_signed_cert_path.yml +1 −4
config/install/views.view.cloud_launch_template.yml +0 −1
deployments/cfn/nested/cloud_orchestrator_full.yaml +2 −1
deployments/cfn/nested/cloud_orchestrator_full_manual_vpc.yaml +2 −1
deployments/cfn/nested/cloud_orchestrator_single.yaml +2 −1
deployments/cfn/nested/cloud_orchestrator_single_ami.yaml +2 −1

Full diff, 7.0.0 to 7.0.1

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.

Critical · Remote code execution · SA-CONTRIB-2026-177
Critical · Remote code execution · SA-CONTRIB-2026-176

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Cloud

Cloud

Send me your Drupal site's address.

Get in touch

Links

Reference