Drupal Core SQL Injection Vulnerability CVE-2026-9082

On May 20, 2026, Drupal released a highly critical security advisory (SA-CORE-2026-004) addressing CVE-2026-9082, an SQL injection vulnerability in the database abstraction layer. The flaw specifically impacts Drupal installations using PostgreSQL as the backend database. While no in-the-wild exploitation has been observed, a proof-of-concept (PoC) detection script was released shortly after the advisory, significantly shortening the window for defensive action.

The vulnerability exists because user-controlled PHP array keys in the PostgreSQL EntityQuery condition handler are concatenated directly into SQL placeholder names without sanitization. Attackers can leverage common interfaces such as JSON:API or REST views to deliver crafted requests that break out of the SQL placeholder grammar. This can lead to full unauthorized data access, modification, or potential remote code execution in specific configurations.

Due to the unauthenticated nature of the attack and Drupal's historical susceptibility to rapid mass exploitation (e.g., Drupalgeddon), immediate patching is strongly recommended for all organizations running PostgreSQL-backed Drupal sites. Exceptional security updates have been provided even for end-of-life versions 10.4 and 11.1.