The Drupal OpenAI Provider module contains a critical SSRF vulnerability that may allow attackers to bypass network controls and access internal services.

This is a Server-Side Request Forgery (CWE-918) vulnerability caused by insufficient sanitization of user-supplied URLs. The vulnerability allows an authenticated attacker with specific permissions to manipulate host URLs to target internal network services or third-party systems.

Successful exploitation of this vulnerability can lead to unauthorized access to internal network resources that are otherwise protected by firewalls. Given the CVSS score of 9.1, this is a critical risk that could result in sensitive data exposure or the lateral movement of an attacker within the organization's infrastructure.

Immediate Action: Update the Drupal OpenAI Provider module to version 1.1.1 or 1.2.2 immediately to apply the necessary input validation patches.

Proactive Monitoring: Monitor server access and egress logs for unusual outbound requests originating from the web server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the web server to block requests to internal network segments and unauthorized external destinations until the update is applied.

Public Exploit Available: No (unknown)

Organizations utilizing the OpenAI Provider module for Drupal must prioritize this update. Despite the lack of confirmed active exploitation, the severity of SSRF vulnerabilities necessitates immediate patching to prevent potential internal network compromise.