Loading vulnerability…
Unauthenticated SQL Injection in Drupal Core PostgreSQL Entity Queries
CVE-2026-9082 is an unauthenticated SQL injection vulnerability in Drupal core's database abstraction API affecting PostgreSQL-backed installations. During case-insensitive Entity Query IN comparisons, the PostgreSQL condition implementation incorporates associative-array keys into SQL placeholder identifiers processed by translateCondition. Attacker-controlled keys can consequently become executable SQL syntax before PDO parameter binding, bypassing the protection normally provided by prepared statements. Reachable attack paths include JSON login requests and, when enabled and anonymously accessible, JSON:API filters. Affected versions are 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10. Successful exploitation can expose or modify database contents, enable application privilege escalation, and potentially lead to remote code execution under additional deployment-specific conditions. MySQL, MariaDB, SQLite, and Drupal 7 are not affected by this specific code path. Exploitation in the wild has been confirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation compromises database confidentiality and potentially integrity and availability within the privileges of Drupal's database account. Boolean-blind extraction through JSON login response differences can disclose administrator identities, password hashes, and other readable database contents. Database modification can enable account or session compromise, unauthorized role changes, and Drupal application takeover. Database operations or injected errors can also disrupt service. Operating-system command execution is conditional rather than inherent: PostgreSQL program-execution functionality requires a superuser or an appropriately privileged role, such as pg_execute_server_program, and remains subject to platform and operating-system restrictions.
If you can’t patch tonight, do this now.
Until patching is complete, restrict unnecessary public access to JSON:API and other exposed request paths that can reach the vulnerable entity-query handling. Restricting JSON:API alone is insufficient because JSON login provides another unauthenticated attack path. Use a least-privileged PostgreSQL account without superuser or server-program execution privileges to reduce potential command-execution impact; this does not prevent SQL injection or compromise of accessible application data. Monitor for SQL syntax in parameter names and array keys, object-valued login names, unusual login HTTP 500 responses, PDO parameter errors, division-by-zero errors, and anomalous PostgreSQL program-execution statements. WAF filtering is only a supplementary control because payloads placed in parameter names can evade value-focused rules.
Patch, then assume compromise.
Upgrade Drupal core to a fixed release in the applicable supported branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, or a later secure release. The fix normalizes condition value arrays with array_values() before backend-specific translation, preventing attacker-controlled keys from becoming SQL placeholder syntax. Emergency manual patches were also released for unsupported Drupal 8.9 and Drupal 9 release lines; installations on these branches should migrate to a supported release rather than rely on emergency patches as a long-term solution.
7 exploits validated by Mallory's analysis. Hidden: 9 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
187 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.