{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-9082","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-9082\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-9082\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3060","id":"3060","resource":"node"},"field_sa_advisory_id":"004","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/akalata\u0022 rel=\u0022nofollow\u0022\u003EAnna Kalata (akalata)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/benjifisher\u0022 rel=\u0022nofollow\u0022\u003EBenji Fisher (benjifisher)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/catch\u0022 rel=\u0022nofollow\u0022\u003E catch (catch)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/damienmckenna\u0022 rel=\u0022nofollow\u0022\u003EDamien McKenna (damienmckenna)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/drumm\u0022 rel=\u0022nofollow\u0022\u003ENeil Drumm (drumm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/heine\u0022 rel=\u0022nofollow\u0022\u003EHeine Deelstra (heine)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/hestenet\u0022 rel=\u0022nofollow\u0022\u003ETim Hestenes Lehnen (hestenet)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/longwave\u0022 rel=\u0022nofollow\u0022\u003EDave Long (longwave)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/quietone\u0022 rel=\u0022nofollow\u0022\u003Equietone  (quietone)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/yesct\u0022 rel=\u0022nofollow\u0022\u003ECathy Theys (yesct)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:None\/A:None\/CI:All\/II:All\/E:Exploit\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EDrupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.\u003C\/p\u003E\n\u003Cp\u003EA vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability can be exploited by anonymous users.\u003C\/p\u003E\n\u003Cp\u003EThis SQL injection vulnerability \u003Cstrong\u003Eonly affects sites using PostgreSQL\u003C\/strong\u003E. However, the third-party dependency updates in these releases apply to all sites.\u003C\/p\u003E\n\u003Ch3\u003EUpdates\u003C\/h3\u003E\n\u003Cp\u003E\u003Cstrong\u003EMay 22 2026, 04:30 UTC:\u003C\/strong\u003E The risk score has been updated to reflect that exploit attempts are now being detected in the wild.\u003C\/p\u003E\n\u003Ch3\u003EUpstream security advisories\u003C\/h3\u003E\n\u003Cp\u003EThe Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important \u003Ca href=\u0022https:\/\/symfony.com\/blog\/category\/security-advisories\u0022 rel=\u0022nofollow\u0022\u003ESecurity Advisories\u003C\/a\u003E that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities.\u003C\/p\u003E\n\u003Cp\u003EDepending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so \u003Cstrong\u003Eupdating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not\u003C\/strong\u003E. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/bbrala\u0022 rel=\u0022nofollow\u0022\u003EBj\u00f6rn Brala (bbrala)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/benjifisher\u0022 rel=\u0022nofollow\u0022\u003EBenji Fisher (benjifisher)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/catch\u0022 rel=\u0022nofollow\u0022\u003E catch (catch)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/longwave\u0022 rel=\u0022nofollow\u0022\u003EDave Long (longwave)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/michaelmaturi\u0022 rel=\u0022nofollow\u0022\u003EMichael Maturi (michaelmaturi)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version.\u003C\/p\u003E\n\u003Ch4\u003EDrupal 11\u003C\/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use Drupal 11.3.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.3.10\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.3.10\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 11.2.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.2.12\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.2.12\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 11.1.x or 11.0.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.1.10\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.1.10\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E\n\n\u003Ch4\u003EDrupal 10\u003C\/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use Drupal 10.6.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.6.9\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.6.9\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 10.5.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.5.10\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.5.10\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 10.4.x or earlier, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.4.10\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.4.10\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Ch4\u003EDrupal 9 and 8\u003C\/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use any version of Drupal 9, try manually applying \u003Ca href=\u0022https:\/\/www.drupal.org\/files\/issues\/2026-05-20\/SA-CORE-2026-004-9.5.patch\u0022 rel=\u0022nofollow\u0022\u003Ethe Drupal 9.5 patch for this issue\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 8.9, try manually applying \u003Ca href=\u0022https:\/\/www.drupal.org\/files\/issues\/2026-05-20\/SA-CORE-2026-004-8.9.patch\u0022 rel=\u0022nofollow\u0022\u003Ethe Drupal 8.9 patch for this issue\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003EDrupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (\u003Ca href=\u0022https:\/\/www.drupal.org\/psa-2021-06-29\u0022 rel=\u0022nofollow\u0022\u003EDrupal 8\u003C\/a\u003E and \u003Ca href=\u0022https:\/\/www.drupal.org\/psa-2023-11-01\u0022 rel=\u0022nofollow\u0022\u003EDrupal 9\u003C\/a\u003E have both reached end-of-life.) Due to this issue\u0027s severity, the unsupported releases and patches for unsupported versions are provided as a best effort. Those unsupported versions \u003Cem\u003Ewill\u003C\/em\u003E still have other, previously disclosed security vulnerabilities.\u003C\/p\u003E","format":"1"},"field_sa_type":"SQL injection","field_issue_last_status_change":"1779424336","field_sa_cve":["CVE-2026-9082"],"field_is_psa":"0","field_affected_versions":"\u003E= 8.9.0 \u003C 10.4.10 || \u003E= 10.5.0 \u003C 10.5.10 || \u003E= 10.6.0 \u003C 10.6.9 || \u003E= 11.0.0 \u003C 11.1.10 || \u003E= 11.2.0 \u003C 11.2.12 || \u003E= 11.3.0 \u003C 11.3.10","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3591135","id":"3591135","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3591136","id":"3591136","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3591137","id":"3591137","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3591139","id":"3591139","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3591140","id":"3591140","resource":"node"}],"nid":"3591142","vid":"14358959","is_new":false,"type":"sa","title":"Drupal core - Highly critical - SQL injection - SA-CORE-2026-004","language":"en","url":"https:\/\/www.drupal.org\/sa-core-2026-004","edit_url":"https:\/\/www.drupal.org\/node\/3591142\/edit","status":"1","promote":"0","sticky":"0","created":"1779300501","changed":"1779424336","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593005","id":16593005,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593006","id":16593006,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593007","id":16593007,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593008","id":16593008,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593009","id":16593009,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593010","id":16593010,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593011","id":16593011,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593012","id":16593012,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593013","id":16593013,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593014","id":16593014,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593015","id":16593015,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593016","id":16593016,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593017","id":16593017,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593018","id":16593018,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593019","id":16593019,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593020","id":16593020,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593021","id":16593021,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16593199","id":16593199,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1779300501"}]}