CVE-2026-9082 Drupal Core PostgreSQL SQL Injection Overview and Takeaways

A critical vulnerability in Drupal Core, tracked as CVE-2026-9082, affects Drupal deployments using a PostgreSQL database.  

The issue allows unauthenticated attackers to perform arbitrary SQL queries via crafted JSON:API or search queries. Successful exploitation may result in full database compromise or remote code execution.  

If Drupal is running with a PostgreSQL backend, immediately upgrade to a patched version and ensure database permissions are properly restricted. Review logs and implement monitoring controls for SQL injection activity. 

What do I need to know? 

• CVE: CVE-2026-9082, 
• Severity: Critical (CVSS 3.1: 9.8) 
• Attack Vector: Remote, unauthenticated 
• Root Cause: Improper neutralization of user-supplied array keys in PostgreSQL query filters 
• Exposure Scope: Only Drupal deployments using PostgreSQL backend are affected 

Products and Systems Affected 

This issue affects the following Drupal Core versions: 

• From 8.9.0 before 10.4.10 
• From 10.5.0 before 10.5.10 
• From  10.6.0 before 10.6.9 
• From 11.0.0 before 11.1.10 
• From 11.2.0 before 11.2.12 
• From 11.3.0 before 11.3.10 

What do I need to do? 

We recommend the following steps to identify and remediate this vulnerability: 

Review and Audit 

• Identify all Drupal environments using PostgreSQL 
• Confirm current Drupal Core versions against affected ranges 
• Review application and web logs for suspicious query parameters or injection patterns 
• Look for use of PostgreSQL-specific functions or operators in inputs (e.g., pg_sleep, ::) 

Patch Immediately 

• Upgrade Drupal Core to the fixed versions listed above 

Mitigation (If Patching Is Delayed) 

• Restrict database permissions: ensure the PostgreSQL user does not have SUPERUSER rights 
• Deploy WAF or IDS signatures for SQL injection detection 
• Implement SIEM correlation rules focused on PostgreSQL exploitation behavior 
• Increase monitoring for anomalous database queries and data access patterns 

NetSPI Product and Services Coverage 

NetSPI’s External Attack Surface Management has released a detection for this CVE. The current detection name is: Vulnerable Version – Drupal – SQL Injection (CVE-2026-9082) 

NetSPI’s Penetration Testing Services can also help identify exposure to these vulnerabilities.

Additional Resources 

• Drupal Security Advisory SA-CORE-2026-004 
• MITRE CVE Entry for CVE-2026-9082 
• NVD Vulnerability Summary