Critical Drupal Core SQL Injection Affects PostgreSQL-Backed Sites
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 25, 2026
Drupal released security updates for CVE-2026-9082, a highly critical SQL injection flaw in Drupal core that affects websites using PostgreSQL databases. The vulnerability stems from improper neutralization of special characters in user input within Drupal's database API, allowing an unauthenticated remote attacker to send crafted requests that can trigger SQL injection.
Successful exploitation could lead to information disclosure, privilege escalation, and in some environments potentially remote code execution. Drupal and downstream defenders urged administrators to upgrade to fixed versions 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, while manual patches were also issued for unsupported 8.9 and 9.5 branches; the flaw's severity was raised to CVSS 9.8 after initial scoring understated the risk.
