Improper certificate validation in Drupal Cloud allows an attacker positioned between a client and the service to provide a forged TLS certificate, which may enable a Man‑in‑the‑Middle attack. Because the backend does not check the certificate chain, a malicious actor can intercept or modify encrypted traffic. The CVE title suggests that such tampering could lead to remote code execution on the server; the description confirms the ability to hijack TLS exchanges, which is a prerequisite for code injection.

Drupal Cloud releases from version 0.0.0 through 7.0.1 are affected. Any deployment of Drupal Cloud within this version range must be updated or patched to include proper certificate validation.

The EPSS score is <1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.8 indicates a moderate severity rating. Exploitation requires an adversary to intercept traffic between a client and the Drupal Cloud service and to supply a forged or self‑signed certificate. This network‑based condition can be satisfied from almost any location that can observe the communication path, making the attack feasible remotely. The lack of certificate verification significantly increases the likelihood of successful exploitation once an attacker can interpose themselves. The potential impact includes data tampering and, as implied by the CVE title, possibly remote code execution.