Drupal Core Highly Critical SQL Injection in Database Abstraction API (PostgreSQL) — SA-CORE-2026-004 / CVE-2026-9082
Drupal Core Highly Critical SQL Injection in Database (TL-2026-0542), also tracked as SA-CORE-2026-004, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-21. It has no confirmed attribution, affects Drupal Drupal core (PostgreSQL backend), references 1 CVE (CVE-2026-9082), maps to 24 MITRE ATT&CK techniques (T1003, T1005, T1041), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0542
- Threat ID
- TL-2026-0542
- Also known as
- SA-CORE-2026-004, PSA-2026-05-18, Drupal PostgreSQL SQLi 2026
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-05-21
- Last reviewed
- 2026-05-21
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, education, healthcare, media, nonprofit, financial, technology
- Target regions
- North America, Europe, Asia-Pacific, Latin America, Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Drupal Core Highly Critical SQL Injection in Database
Malware and tooling: Nuclei, sqlmap - S0225
Drupal core ships a highly critical (20/25) unauthenticated SQL injection in its database abstraction layer that affects only sites backed by PostgreSQL. SA-CORE-2026-004 / CVE-2026-9082 lets anonymous attackers send specially crafted HTTP requests that result in arbitrary SQL execution, enabling information disclosure, privilege escalation, and follow-on remote code execution. Drupal pre-warned the community via PSA-2026-05-18 that exploits were expected within hours of disclosure; patches landed for all supported branches and hotfixes were issued even for EOL 8.9 and 9.5.
How Drupal Core Highly Critical SQL Injection in Database works
On May 20, 2026, the Drupal Security Team published SA-CORE-2026-004, assigning CVE-2026-9082, after a two-day pre-disclosure window (PSA-2026-05-18). The advisory describes a vulnerability in Drupal core's Database Abstraction API in which specially crafted requests are processed in a way that produces unsafe SQL when the underlying driver is PostgreSQL. The result is arbitrary SQL injection executable by anonymous users with no special privileges, scoring 20/25 on Drupal's NIST-derived risk model (AC:None / A:None / CI:All / II:All / E:Theoretical / TD:Uncommon). The flaw was reported by independent researcher Michael Maturi and remediated by Drupal core security team members Björn Brala, Benji Fisher, catch, Lee Rowlands, Dave Long, Drew Webber, and Jess.
The defect is PostgreSQL-driver-specific: the database abstraction layer's quoting / placeholder handling fails to neutralize a class of input only when the active driver is pgsql, leaving MySQL and MariaDB sites unaffected. Because Drupal's API normally serves as the trusted boundary between PHP code and the database, the entire body of contributed modules, themes, and Drupal core code paths that pass user-controlled data through the API inherit the flaw — meaning the attack surface includes virtually every anonymous-reachable endpoint that performs a database read or write (search, node listings, comment forms, REST/JSON:API endpoints, view filters, taxonomy autocomplete, etc.).
Impact ranges from data disclosure (extraction of users table, password hashes, session records, configuration secrets) to integrity loss (administrator account creation, privilege escalation by toggling roles/permissions or session tokens) to full code execution (writing PHP into a tracked-file table that is later rendered, abusing the file_managed or config tables, or coupling with insecure Twig/PHP filter modules). The Drupal Security Team's framing — invoking the same pre-disclosure PSA pattern used for SA-CORE-2014-005 ('Drupalgeddon') and SA-CORE-2018-002 ('Drupalgeddon 2') — signals that the bug is trivially exploitable at scale and that opportunistic mass-scanning is expected within hours.
Drupal Steward (the WAF-fronting subscription service operated by the Drupal Association) was updated with filtering rules ahead of disclosure, providing transitional protection to subscribers; non-Steward sites had no compensating control prior to the 17:00–21:00 UTC patch window. End-of-life branches 11.1.x and 10.4.x received fixes despite being outside the normal support window, and manual patch files were published for Drupal 8.9 and 9.5, an explicit signal of severity. The release packages also bundled upstream Symfony and Twig security fixes, so admins are urged to upgrade even on MySQL/MariaDB stacks.
The deployed footprint of Drupal — heavily weighted toward government (federal, state, municipal), higher education, large nonprofits, healthcare, and major media — combined with the prevalence of PostgreSQL in regulated and university environments, makes this advisory operationally comparable to Drupalgeddon-class events. Defenders should treat any unpatched PostgreSQL-backed Drupal site as compromise-pending and prioritize emergency patching, WAF virtual patching for SQL injection on common Drupal endpoints, database audit logging review, and post-patch hunt for newly created administrative users, modified file_managed rows, anomalous PHP files in sites/default/files, and unexpected outbound connections from web tier hosts.
MITRE ATT&CK techniques used in TL-2026-0542
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter
Defense Evasion
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1526 Cloud Service Discovery
Privilege Escalation
Persistence
Impact
T1491 Defacement; T1565 Data Manipulation
persistence
T1505 Server Software Component
defense-impairment
T1556 Modify Authentication Process
Resource Development
Reconnaissance
Affected products and versions in Drupal Core Highly Critical SQL Injection in Database
- Drupal — Drupal core (PostgreSQL backend)
Vulnerable versions: >= 8.9.0 < 10.4.10; >= 10.5.0 < 10.5.10; >= 10.6.0 < 10.6.9; >= 11.0.0 < 11.1.10; >= 11.2.0 < 11.2.12; >= 11.3.0 < 11.3.10
Fixed in: 11.3.10; 11.2.12; 11.1.10; 10.6.9; 10.5.10; 10.4.10; 9.5.11 (hotfix); 8.9.20 (hotfix) - Drupal — Drupal core database abstraction API (pgsql driver)
Vulnerable versions: all branches 8.9+ prior to fixed releases
Fixed in: branch-aligned fixed releases listed above
Remediation for Drupal Core Highly Critical SQL Injection in Database
Patches
- Drupal 11.3.10
- Drupal 11.2.12
- Drupal 11.1.10 (EOL branch, security-only)
- Drupal 10.6.9
- Drupal 10.5.10
- Drupal 10.4.10 (EOL branch, security-only)
- Drupal 9.5.11 hotfix patch file (EOL)
- Drupal 8.9.20 hotfix patch file (EOL)
Immediate actions
- Upgrade Drupal core to 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, or 10.4.10 immediately on every PostgreSQL-backed site.
- Apply Drupal-supplied hotfix patches for EOL branches 9.5 (target 9.5.11) and 8.9 (target 8.9.20) if unable to upgrade to a supported branch.
- If patching cannot occur inside the 17:00-21:00 UTC change window, put the site into maintenance/read-only mode or take it offline until patched.
- Front affected sites with a WAF rule that blocks classic SQL injection metacharacter sequences (UNION SELECT, pg_sleep, --, /*, ;-- ) on anonymous endpoints, especially /search, /node/*, /jsonapi/*, /entity/* and view exposed filters.
Workarounds
- Switch the database backend from PostgreSQL to MySQL/MariaDB (not realistic short-term but eliminates the vector).
- Temporarily set the site to anonymous-read-only via robots.txt + reverse-proxy ACLs while patches are staged.
- Front the site with Drupal Steward or an equivalent WAF profile until patched.
Longer-term hardening
- Enable PostgreSQL statement logging (log_statement = 'mod' or 'all') and ship to SIEM for retroactive hunt.
- Subscribe high-value Drupal estates to Drupal Steward for advance protection on future SA-CORE PSAs.
- Restrict the Drupal database role to least privilege: deny COPY ... TO PROGRAM, deny superuser, deny ability to create extensions.
- Segment Drupal web tier from internal networks; egress-filter the DB host to deny outbound internet.
- Adopt automated Drupal patch pipelines (e.g., composer update + CI smoke tests) so future Drupal PSAs can be patched within the 4-hour pre-disclosure window.
CVEs associated with Drupal Core Highly Critical SQL Injection in Database
Weaknesses (CWE) in Drupal Core Highly Critical SQL Injection in Database
CWE-89, CWE-20, CWE-707
Timeline of Drupal Core Highly Critical SQL Injection in Database
- Independent researcher Michael Maturi privately reports the PostgreSQL SQL injection in Drupal's database abstraction API to the Drupal Security Team (approximate; private disclosure window typically 60-120 days before patch).
- Drupal Security Team (Björn Brala, Benji Fisher, catch, Lee Rowlands, Dave Long, Drew Webber, Jess) develops cross-branch fixes covering 11.3.x, 11.2.x, 11.1.x, 10.6.x, 10.5.x, 10.4.x, plus EOL hotfixes for 9.5 and 8.9.
- Drupal Steward WAF subscribers receive advance virtual-patching rules covering known attack vectors for the upcoming SA-CORE-2026-004.
- Drupal publishes PSA-2026-05-18 announcing a 'highly critical' core release scheduled for May 20, 2026 17:00-21:00 UTC and warns exploits may be developed within hours of disclosure.
- BleepingComputer, The Register, The Hacker News, SecurityWeek, and university security offices (UC Berkeley ISO, University of Michigan Safe Computing) amplify the pre-disclosure PSA; admins begin staging environments.
- Composer/Drush update traffic spikes globally as administrators apply fixed branches (11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, 10.4.10) and bundled Symfony/Twig dependency updates.
- Drupal publishes SA-CORE-2026-004 / CVE-2026-9082 inside the 17:00-21:00 UTC window: highly critical (20/25) anonymous SQL injection in Database Abstraction API affecting only PostgreSQL-backed sites; patches released for all supported branches plus EOL hotfix files for 9.5.11 and 8.9.20.
- Opportunistic mass-scanning against Drupal endpoints (/search, /node, /jsonapi, /entity, /views/* exposed filters) is expected to begin within 24-72 hours of disclosure, consistent with Drupalgeddon (SA-CORE-2014-005) and Drupalgeddon 2 (SA-CORE-2018-002) historical patterns.
- CISA KEV addition expected if in-the-wild exploitation is confirmed; defenders should pre-plan FCEB and SLTT compliance deadlines (typically BOD 22-01 standard 14-21 days for critical CVEs).
- Long-tail exploitation against unpatched government, education, and small-business Drupal sites expected to continue for 6-18 months, mirroring Drupalgeddon-class patch-lag curves.
- As of 2026-05-29, CVE-2026-9082 (SA-CORE-2026-004) is patched but under active mass exploitation: Imperva tracked 15,000+ attacks on ~6,000 PostgreSQL Drupal sites in 65 countries within 48 hours. CISA added it to KEV on 2026-05-22 (fed deadline May 27); long-tail n-day exploitation against unpatched sites continues.
Sources cited for Drupal Core Highly Critical SQL Injection in Database
- Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
- Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18
- Drupal Releases SA-CORE-2026-004 Fixing Critical Database Injection Vulnerability
- Drupal critical update to fix bug with high exploitation risk
- Drupal warns admins to brace for highly critical core patch
- Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare
- Drupal Patches Highly Critical SQL Injection That Lets Anonymous Attackers Hijack PostgreSQL-Backed Sites
- Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation
- Drupal Core Vulnerability PSA-2026-05-18 (UC Berkeley ISO)
- Apply Updates for Drupal Core Security Release May 20, 2026 (University of Michigan Safe Computing)
- Drupal Highly Critical Security Release Planned for 20 May 2026 Across Supported Core Branches
- Drupal Core Patch Drops Today: No-Login Flaw Puts Government and University Sites at Immediate Risk
- Drupal Security advisories for core (index)
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command
- MITRE ATT&CK T1190 - Exploit Public-Facing Application
Threats related to Drupal Core Highly Critical SQL Injection in Database
Detection coverage for TL-2026-0542
As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0542 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.