A critical vulnerability in Drupal Core, tracked as CVE-2026-9082, affects Drupal deployments using a PostgreSQL database.  

The issue allows unauthenticated attackers to perform arbitrary SQL queries via crafted JSON:API or search queries. Successful exploitation may result in full database compromise or remote code execution.  

If Drupal is running with a PostgreSQL backend, immediately upgrade to a patched version and ensure database permissions are properly restricted. Review logs and implement monitoring controls for SQL injection activity. 

What do I need to know? 

  • CVE: CVE-2026-9082
  • Severity: Critical (CVSS 3.1: 9.8) 
  • Attack Vector: Remote, unauthenticated 
  • Root Cause: Improper neutralization of user-supplied array keys in PostgreSQL query filters 
  • Exposure Scope: Only Drupal deployments using PostgreSQL backend are affected 

Products and Systems Affected 

This issue affects the following Drupal Core versions: 

  • From 8.9.0 before 10.4.10 
  • From 10.5.0 before 10.5.10 
  • From  10.6.0 before 10.6.9 
  • From 11.0.0 before 11.1.10 
  • From 11.2.0 before 11.2.12 
  • From 11.3.0 before 11.3.10 

What do I need to do? 

We recommend the following steps to identify and remediate this vulnerability: 

Review and Audit 

  • Identify all Drupal environments using PostgreSQL 
  • Confirm current Drupal Core versions against affected ranges 
  • Review application and web logs for suspicious query parameters or injection patterns 
  • Look for use of PostgreSQL-specific functions or operators in inputs (e.g., pg_sleep, ::) 

Patch Immediately 

  • Upgrade Drupal Core to the fixed versions listed above 

Mitigation (If Patching Is Delayed) 

  • Restrict database permissions: ensure the PostgreSQL user does not have SUPERUSER rights 
  • Deploy WAF or IDS signatures for SQL injection detection 
  • Implement SIEM correlation rules focused on PostgreSQL exploitation behavior 
  • Increase monitoring for anomalous database queries and data access patterns 

NetSPI Product and Services Coverage 

NetSPI’s External Attack Surface Management has released a detection for this CVE. The current detection name is: Vulnerable Version – Drupal – SQL Injection (CVE-2026-9082) 

NetSPI’s Penetration Testing Services can also help identify exposure to these vulnerabilities.

Additional Resources