Drupal Core

CVE-2026-9082 – SQL Injection Vulnerability via Database Abstraction API Leading to Information Disclosure and Potential Remote Code Execution

Affects

• Drupal Core (Content Management System)
• Versions:
  • Drupal 8.9.0 (end-of-life, exceptional patch available)
  • Drupal 9.0.x (end-of-life, exceptional patch available)
  • Drupal 10.4.9 and below
  • Drupal 10.5.0 – 10.5.9
  • Drupal 10.6.0 – 10.6.8
  • Drupal 11.0.0 – 11.1.9
  • Drupal 11.2.0 – 11.2.11
  • Drupal 11.3.0 – 11.3.9
• Components:
  • Database Abstraction API
  • PostgreSQL EntityQuery condition handler
• Files:
  • core/lib/Drupal/Core/Database/Driver/pgsql/ – PostgreSQL driver components
• Functions:
  • PostgreSQL EntityQuery condition handling logic

NOT VULNERABLE:

• Drupal sites not using PostgreSQL databases (MySQL, MariaDB, SQLite are safe)
• Drupal 7.x

Description

CVE-2026-9082 is a critical SQL injection vulnerability in Drupal Core’s database abstraction API, specifically affecting the PostgreSQL EntityQuery condition handler .

Drupal’s database abstraction API is designed to sanitize and parameterize all database queries before they reach the backend database, preventing SQL injection attacks . However, a flaw exists where user-controlled PHP array keys can reach SQL placeholder construction without proper sanitization .

The vulnerable code in the PostgreSQL driver allows specially crafted array keys in API requests to bypass the intended query sanitization. When an unauthenticated attacker sends a crafted request containing specific array structures as filter parameters, these unsanitized keys flow directly into the construction of SQL placeholder names . The attacker can then inject arbitrary SQL commands into the generated query.

The issue is triggered through two primary unauthenticated attack paths:

1. The JSON login endpoint (/user/login?_format=json)
2. The JSON:API filter syntax (e.g., /jsonapi/node/article endpoints)

Drupal fixed this vulnerability by applying the array_values() function, which strips attacker-supplied keys and replaces them with safe numeric indexes .

The vulnerability is specific to PostgreSQL-backed Drupal deployments .

Attack Vector

Primary Attack Vector:
Remote / Unauthenticated (Network Access)

Attack Scenario:

1. An attacker identifies a Drupal site running on a PostgreSQL database backend (version detection or trial and error) .
2. The attacker sends a specially crafted HTTP request to an unauthenticated endpoint, such as:
   • /user/login?_format=json (JSON login endpoint)
   • /jsonapi/node/article with crafted filter parameters
3. The crafted request includes malicious array keys in the JSON payload (e.g., 0) OR 1=1--, _)) AND 1=1--, or array keys containing PostgreSQL functions like pg_sleep() for time-based detection) .
4. Drupal’s PostgreSQL EntityQuery condition handler processes these unsanitized array keys, allowing them to flow into the construction of SQL placeholder names .
5. The injected SQL commands execute against the PostgreSQL database with the web application’s database privileges.

Key Characteristics:

• No authentication required – Anonymous users can exploit
• No user interaction required – Zero-click exploitation
• Exploitable over network via HTTP
• Database-specific vulnerability – Only affects PostgreSQL deployments
• Two identified unauthenticated trigger paths – JSON login endpoint and JSON:API filter syntax

Conditions Increasing Risk:

• Public-facing Drupal sites with PostgreSQL backend
• Default configuration unchanged
• No Web Application Firewall (WAF) in place
• Lack of network segmentation
• Legacy or end-of-life Drupal versions (8.9, 9.5) still in production

Impact

Successful exploitation allows:

• Arbitrary SQL command execution against the PostgreSQL database
• Information disclosure – Attackers can dump sensitive database contents, including user credentials, session tokens, and private content
• Data modification or deletion – Attackers can alter or destroy database content
• Privilege escalation – Depending on database privileges and configuration, attackers can elevate their access within the Drupal application
• Remote code execution – In certain configurations, successful SQL injection can lead to remote code execution on the underlying server (e.g., through PostgreSQL’s COPY program functionality or user-defined functions)

The impact is complete database compromise on affected PostgreSQL-backed Drupal sites, with potential for full server takeover in certain configurations.

Observed Exploitation & Threat Activity

• Public Disclosure: May 20, 2026 (SA-CORE-2026-004)
• Patch Availability: Included with disclosure
• Public PoC: A detection PoC and reproduction lab were published on the same day as disclosure; the patch diff was shared publicly within hours
• In-the-Wild Exploitation:
  • No confirmed exploitation observed as of May 21, 2026 (Drupal advisory describes exploit status as “Theoretical”)
  • However, over 15,000 attack attempts were detected targeting nearly 6,000 individual sites across 65 countries within days of disclosure
  • Attack activity currently appears to be probing and reconnaissance rather than active exploitation
• Primary Targets: Gaming (26%) and Financial Services (23%) sectors
• Attack Patterns: JSON:API filter probes, time-based SQL injection using pg_sleep(), UNION-style probes
• Historical Context: Drupal has a well-documented history of critical vulnerabilities (e.g., Drupalgeddon – CVE-2018-7600, CVE-2018-7602) that experienced rapid mass exploitation; similar behavior is expected for CVE-2026-9082

Severity & Metrics

• CVSS v3.1 (CISA-ADP): Medium (6.5)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Drupal’s Internal Risk Rating: 20/25 (“Highly Critical”)

Drupal rates this vulnerability significantly higher than the NVD CVSS score, noting that the confidentiality impact includes “all non-public data accessible” and the integrity impact is “all data modifiable or deletable” . Given the unauthenticated attack vector and potential for privilege escalation/RCE, the Drupal risk rating better reflects the potential severity for affected PostgreSQL configurations .

Relevant CWE:

• CWE-89 – Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
• CWE-20 – Improper Input Validation

Patch & Vendor Status

• Official Patches Available: Yes – included in Drupal Security Advisory SA-CORE-2026-004 (May 20, 2026)
• Fixed Versions:

• Drupal Steward customers received advanced signature protection prior to public disclosure
• Important Note: The security release also includes coordinated upstream security updates for Symfony and Twig. Even sites not using PostgreSQL should update to address these separate framework vulnerabilities

Mitigation & Remediation

Immediate Actions

• Update Drupal core immediately to the appropriate patched version for your branch
• For Drupal 8.9 or 9.5 sites (end-of-life), apply the hotfix files published by Drupal for versions 8.9.20 or 9.5.11
• If patching cannot be applied immediately:
  • Disable public access to affected endpoints (JSON login and JSON:API)
  • Restrict access to authenticated users only where possible
  • Deploy a Web Application Firewall (WAF) with SQL injection detection rules
  • Temporarily isolate affected Drupal implementations until patches can be applied

Defensive Measures

• Migrate from PostgreSQL to MySQL/MariaDB if feasible (though patching is the preferred solution)
• Deploy a WAF – Imperva reports that WAF customers are protected against exploitation attempts
• Enable Drupal Steward if available for your Drupal distribution
• Monitor database access logs for suspicious SQL patterns, especially those containing:
  • pg_sleep() function calls
  • OR 1=1 patterns
  • UNION statements
  • Unusual array key structures in JSON requests
• Review and restrict JSON:API access – Disable JSON:API if not required
• Implement network segmentation for Drupal application servers

Detection & Hunting

Indicators of Attempted Exploitation:

• HTTP requests containing crafted array keys such as:
  • 0), 0)) OR 1=1--
  • _) AND 1=1--
  • Array keys with embedded parentheses and SQL operators
• Requests to /user/login?_format=json with unusual JSON structures
• Requests to /jsonapi/node/* endpoints with suspicious filter parameters
• POST/PATCH requests containing nuclei_sa_core_2026_004, nuclei-probe, or nuclei-probe-miss markers (indicating automated scanning with Nuclei templates)
• Time-based SQL injection attempts using PostgreSQL functions like pg_sleep(5)
• Unexpected database errors in application logs related to SQL syntax
• Unusual outbound database connections or queries from the Drupal application

Log Analysis:

• Check web server access logs for the patterns above, focusing on POST requests to /user/login?_format=json and /jsonapi/ endpoints
• Review Drupal watchdog logs for database error entries
• Monitor PostgreSQL query logs for suspicious queries containing user-controlled array keys

Observed Attack Attempts (Post-Disclosure):

• Over 15,000 attack attempts across 65 countries
• Primary targets: Gaming (26%) and Financial Services (23%)
• Most activity appears to be scanning/probing rather than active exploitation

Post-Incident Response

If exploitation is suspected:

1. Isolate affected system from the network immediately to prevent data exfiltration or lateral movement
2. Preserve forensic evidence (web server logs, Drupal logs, PostgreSQL query logs, network captures)
3. Rotate all credentials and secrets stored in or accessible from the compromised database (user passwords, API keys, session tokens)
4. Audit database for unauthorized changes – Review recent INSERT, UPDATE, DELETE operations
5. Check for backdoors – Review Drupal modules, user accounts with administrative privileges, and recently added files in web root
6. Assume full compromise – Do not simply change passwords; the attacker may have escalated privileges
7. Rebuild system from a trusted backup or clean installation after applying patches

References

• https://www.drupal.org/sa-core-2026-004
• https://nvd.nist.gov/vuln/detail/CVE-2026-9082
• https://www.tenable.com/blog/cve-2026-9082-highly-critical-sql-injection-vulnerability-in-drupal-core-sa-core-2026-004
• https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-9082-in-drupal-core/
• https://socprime.com/blog/cve-2026-9082-analysis/
• https://security.berkeley.edu/news/drupal-core-sql-injection-vulnerability-cve-2026-9082
• https://cwe.mitre.org/data/definitions/89.html