Drupal Core Highly Critical SQL Injection in Database Abstraction API (PostgreSQL) — SA-CORE-2026-004 / CVE-2026-9082 — Threadlinqs Intelligence
As of 2026-05-30, Drupal Core Highly Critical SQL Injection in Database Abstraction API (PostgreSQL) — SA-CORE-2026-004 / CVE-2026-9082 is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0542 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Drupal core ships a highly critical (20/25) unauthenticated SQL injection in its database abstraction layer that affects only sites backed by PostgreSQL. SA-CORE-2026-004 / CVE-2026-9082 lets
On May 20, 2026, the Drupal Security Team published SA-CORE-2026-004, assigning CVE-2026-9082, after a two-day pre-disclosure window (PSA-2026-05-18). The advisory describes a vulnerability in Drupal core's Database Abstraction API in which specially crafted requests are processed in a way that produces unsafe SQL when the underlying driver is PostgreSQL. The result is arbitrary SQL injection executable by anonymous users with no special privileges, scoring 20/25 on Drupal's NIST-derived risk model (AC:None / A:None / CI:All / II:All / E:Theoretical / TD:Uncommon). The flaw was reported by independent researcher Michael Maturi and remediated by Drupal core security team members Björn Brala, Benji Fisher, catch, Lee Rowlands, Dave Long, Drew Webber, and Jess.
The defect is PostgreSQL-driver-specific: the database abstraction layer's quoting / placeholder handling fails to neutralize a class of input only when the active driver is pgsql, leaving MySQL and MariaDB sites unaffected. Because Drupal's API normally serves as the trusted boundary between PHP code and the database, the entire body of contributed modules, themes, and Drupal core code paths that pass user-controlled data through the API inherit the flaw — meaning the attack surface includes virtually every anonymous-reachable endpoint that performs a database read or write (search, node listings, comment forms, REST/JSON:API endpoints, view filters, taxonomy autocomplete, etc.).
Impact ranges from data disclosure (extraction of users table, password hashes, session records, configuration secrets) to integrity loss (administrator account creation, privilege escalation by toggling roles/permissions or session tokens) to full code execution (writing PHP into a tracked-file table that is later rendered, abusing the file_managed or config tables, or coupling with insecure Twig/PHP filter modules). The Drupal Security Team's framing — invoking the same pre-disclosure PSA pattern used for SA-CORE-2014-005 ('Drupalgeddon') and SA-CORE-2018-002 ('Drupalgeddon 2') — signals that the bug is trivially exploitable at scale and that opportunistic mass-scanning is expected within hours.
Drupal Steward (the WAF-fronting subscription service operated by the Drupal Association) was updated with filtering rules ahead of disclosure, providing transitional protection to subscribers; non-Steward sites had no compensating control prior to the 17:00–21:00 UTC patch window. End-of-life branches 11.1.x and 10.4.x received fixes despite being outside the normal support window, and manual patch files were published for Drupal 8.9 and 9.5, an explicit signal of severity. The release packages also bundled upstream Symfony and Twig security fixes, so admins are urged to upgrade even on MySQL/MariaDB stacks.
The deployed footprint of Drupal — heavily weighted toward government (federal, state, municipal), higher education, large nonprofits, healthcare, and major media — combined with the prevalence of PostgreSQL in regulated and university environments, makes this advisory operationally comparable to Drupalgeddon-class events. Defenders should treat any unpatched PostgreSQL-backed Drupal site as compromise-pending and prioritize emergency patching, WAF virtual patching for SQL injection on common Drupal endpoints, database audit logging review, and post-patch hunt for newly created administrative users, modified file_managed rows, anomalous PHP files in sites/default/files, and unexpected outbound connections from web tier hosts.
Weaknesses (CWE)
CWE-89, CWE-20, CWE-707
Target sectors: government, education, healthcare, media, nonprofit, financial, technology
Target regions: North America, Europe, Asia-Pacific, Latin America, Global
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-9082, T1595, T1592, T1587, T1190, T1078, T1059, T1505, T1136, T1505, T1098