Drupal SQL Injection Vulnerability

CVE-2026-9082 is a highly critical SQL injection vulnerability affecting Drupal core sites configured to use PostgreSQL as the backend database. The vulnerability exists in Drupal’s database abstraction API, where specially crafted requests can bypass query sanitization and result in arbitrary SQL injection. The issue is reachable by anonymous users and requires no authentication or prior privileges. Drupal rates the issue as “Highly Critical,” with a 20 out of 25 security risk score. The vulnerability is rated as Critical (CVSS 9.8).

Technical Details

Drupal is an open-source content management system used to build and operate websites, intranets, and digital experience platforms across government, higher education, media, and enterprise environments.

In affected deployments, Drupal core’s database abstraction API fails to properly sanitize certain crafted requests when the site uses PostgreSQL. Successful exploitation enables arbitrary SQL execution against the Drupal site database. Potential outcomes include credential exposure, unauthorized data access, privilege escalation, database manipulation, and possible remote code execution paths depending on site configuration and connected services.

The vulnerability affects PostgreSQL-backed Drupal deployments only. 

NodeZero® Proactive Security Platform — Rapid Response

A NodeZero Rapid Response test has been developed to safely validate whether this SQL injection vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.

Re-run the test: Confirm the vulnerability is no longer exploitable after remediation

Run the Rapid Response test: Launch from the NodeZero platform to determine whether affected Drupal instances using PostgreSQL are exploitable

Patch immediately: Upgrade Drupal core to a fixed release based on your supported branch

Stop Guessing, Start Proving