CVE-2026-9082 – Highly Critical Pre‑Auth SQL Injection in Drupal Core (PostgreSQL)

Key takeaways

• Critical pre‑authentication SQL injection affecting Drupal sites that use PostgreSQL.
• Active exploitation reported within 48 hours of disclosure; a public PoC can achieve remote code execution when the database role is privileged.
• Immediate patch (SA‑CORE‑2026‑004) required; verify version and monitor for exploitation attempts.
• Added to CISA KEV – federal agencies must remediate.

Overview

On May 20 2026, the Drupal security team published advisory SA‑CORE‑2026‑004 and released a highly critical patch for a pre‑authentication SQL injection flaw in Drupal core. The vulnerability, identified as CVE-2026-9082, only affects installations that use PostgreSQL as the database backend. Within 48 hours of the advisory, threat‑intel feeds reported active exploitation attempts, and by May 23 the number of reported active exploits peaked at 18 in a single day. Over the first three weeks, the vulnerability accumulated 193 mentions across public sources, indicating sustained attacker interest.

Technical Details

The flaw resides in a core function that builds a dynamic SQL query using user‑controlled input without proper sanitisation. Because the query is executed with the web‑application’s database connection, an unauthenticated attacker can inject arbitrary SQL statements. When the underlying PostgreSQL role has elevated privileges (e.g., superuser), the injection can be chained to a system command, leading to remote code execution (RCE).

A typical exploit payload injects a UNION SELECT clause:

POST /?q=node/1 HTTP/1.1
Host: vulnerable-drupal.example.com
Content-Type: application/x-www-form-urlencoded

field_name=1%27%20UNION%20SELECT%20pg_catalog.pg_sleep(10)%20--+

The payload forces PostgreSQL to execute the injected query. A public PoC released on May 28 demonstrates escalation to RCE by invoking functions such as COPY … PROGRAM when the DB role is privileged.

Severity & Impact

Affected Products

• Drupal core (all versions prior to the May 20 2026 security update) when configured with PostgreSQL.
• The vulnerability does not affect Drupal installations using MySQL, MariaDB, or SQLite.

For the complete list of affected versions, see the CVE page.

Actionable Insights – What to Do Now

1. Identify: Determine whether your site runs Drupal and uses PostgreSQL. Check settings.php for the $databases array.
2. Verify version: Run drush status or composer show drupal/core to confirm the core version. Any version released before 2026‑05‑20 is vulnerable.
3. Patch immediately: Apply the official security update SA‑CORE‑2026‑004. For Composer‑based sites, run composer update drupal/core --with-all-dependencies. For Drush users, drush up drupal will pull the patched version.
4. Confirm remediation: After updating, verify the patched files (e.g., core/includes/database.inc) match the upstream release. Re‑run drush status to ensure the new version is active.
5. Log review: Search web server and Drupal logs for suspicious requests targeting the vulnerable endpoint (e.g., unusual query strings, %27 UNION SELECT). Example grep: grep -i "union select" /var/log/apache2/access.log.
6. Deploy WAF/IPS rules: Block generic SQLi patterns (e.g., UNION SELECT, pg_sleep, COPY … PROGRAM) on the application firewall.
7. Temporary mitigation (if patch cannot be applied immediately):
   • Switch the database backend to MySQL/MariaDB where the flaw does not exist.
   • Restrict database role privileges; ensure the Drupal DB user does not have superuser rights.
   • Add a rule in the web server to reject requests containing %27 or --+ in query parameters.
8. Monitor: Subscribe to real‑time threat intel on the VulnSocial CVE page for new exploit code or activity spikes.
9. Post‑patch testing: Run a security scanner (e.g., OWASP ZAP, Burp Suite) with the PoC payload to confirm the injection vector is closed.

Remediation & Mitigation

• Patch: Apply SA‑CORE‑2026‑004 without delay.
• Hardening: Ensure the Drupal database user has the minimum required privileges; avoid superuser roles.
• Network segmentation: Isolate the database server from the public internet.
• WAF signatures: Deploy signatures that detect PostgreSQL‑specific injection patterns.
• Continuous monitoring: Use SIEM alerts for anomalous SQL queries or high‑frequency request patterns.

Bottom Line

CVE-2026-9082 is a highly critical pre‑authentication SQL injection that has been actively exploited within days of disclosure. It only impacts Drupal sites using PostgreSQL. Immediate patch deployment, verification, and active monitoring are essential to prevent data loss or remote code execution.

References

• https://vulnsocial.com/cve/CVE-2026-9082
• https://vulnsocial.com

#CVE #Critical #SQLi #Drupal #PostgreSQL #RCE #CISAKEV #CVE20269082