# Drupal Core Highly Critical SQL Injection in Database Abstraction API (PostgreSQL) — SA-CORE-2026-004 / CVE-2026-9082

> Drupal core ships a highly critical (20/25) unauthenticated SQL injection in its database abstraction layer that affects only sites backed by PostgreSQL. SA-CORE-2026-004 / CVE-2026-9082 lets anonymous attackers send specially crafted HTTP requests that result in arbitrary SQL execution, enabling information disclosure, privilege escalation, and follow-on remote code execution. Drupal pre-warned the community via PSA-2026-05-18 that exploits were expected within hours of disclosure; patches landed for all supported branches and hotfixes were issued even for EOL 8.9 and 9.5.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0542
- **ID:** TL-2026-0542
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-9082

## Description

On May 20, 2026, the Drupal Security Team published SA-CORE-2026-004, assigning CVE-2026-9082, after a two-day pre-disclosure window (PSA-2026-05-18). The advisory describes a vulnerability in Drupal core's Database Abstraction API in which specially crafted requests are processed in a way that produces unsafe SQL when the underlying driver is PostgreSQL. The result is arbitrary SQL injection executable by anonymous users with no special privileges, scoring 20/25 on Drupal's NIST-derived risk model (AC:None / A:None / CI:All / II:All / E:Theoretical / TD:Uncommon). The flaw was reported by independent researcher Michael Maturi and remediated by Drupal core security team members Björn Brala, Benji Fisher, catch, Lee Rowlands, Dave Long, Drew Webber, and Jess.

The defect is PostgreSQL-driver-specific: the database abstraction layer's quoting / placeholder handling fails to neutralize a class of input only when the active driver is pgsql, leaving MySQL and MariaDB sites unaffected. Because Drupal's API normally serves as the trusted boundary between PHP code and the database, the entire body of contributed modules, themes, and Drupal core code paths that pass user-controlled data through the API inherit the flaw — meaning the attack surface includes virtually every anonymous-reachable endpoint that performs a database read or write (search, node listings, comment forms, REST/JSON:API endpoints, view filters, taxonomy autocomplete, etc.).

Impact ranges from data disclosure (extraction of users table, password hashes, session records, configuration secrets) to integrity loss (administrator account creation, privilege escalation by toggling roles/permissions or session tokens) to full code execution (writing PHP into a tracked-file table that is later rendered, abusing the file_managed or config tables, or coupling with insecure Twig/PHP filter modules). The Drupal Security Team's framing — invoking the same pre-disclosure PSA pattern used for SA-CORE-2014-005 ('Drupalgeddon') and SA-CORE-2018-002 ('Drupalgeddon 2') — signals that the bug is trivially exploitable at scale and that opportunistic mass-scanning is expected within hours.

Drupal Steward (the WAF-fronting subscription service operated by the Drupal Association) was updated with filtering rules ahead of disclosure, providing transitional protection to subscribers; non-Steward sites had no compensating control prior to the 17:00–21:00 UTC patch window. End-of-life branches 11.1.x and 10.4.x received fixes despite being outside the normal support window, and manual patch files were published for Drupal 8.9 and 9.5, an explicit signal of severity. The release packages also bundled upstream Symfony and Twig security fixes, so admins are urged to upgrade even on MySQL/MariaDB stacks.

The deployed footprint of Drupal — heavily weighted toward government (federal, state, municipal), higher education, large nonprofits, healthcare, and major media — combined with the prevalence of PostgreSQL in regulated and university environments, makes this advisory operationally comparable to Drupalgeddon-class events. Defenders should treat any unpatched PostgreSQL-backed Drupal site as compromise-pending and prioritize emergency patching, WAF virtual patching for SQL injection on common Drupal endpoints, database audit logging review, and post-patch hunt for newly created administrative users, modified file_managed rows, anomalous PHP files in sites/default/files, and unexpected outbound connections from web tier hosts.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1098 Account Manipulation
- T1556 Modify Authentication Process
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1102 Web Service
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1491 Defacement

## Sources

- [Drupal core - Highly critical - SQL injection - SA-CORE-2026-004](https://www.drupal.org/sa-core-2026-004)
- [Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18](https://www.drupal.org/psa-2026-05-18)
- [Drupal Releases SA-CORE-2026-004 Fixing Critical Database Injection Vulnerability](https://www.thedroptimes.com/69877/drupal-sa-core-2026-004-postgresql-sql-injection)
- [Drupal critical update to fix bug with high exploitation risk](https://www.bleepingcomputer.com/news/security/drupal-critical-update-to-fix-bug-with-high-exploitation-risk/)
- [Drupal warns admins to brace for highly critical core patch](https://www.theregister.com/security/2026/05/19/drupal-warns-admins-to-brace-for-highly-critical-core-patch/)
- [Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare](https://thehackernews.com/2026/05/drupal-to-release-urgent-core-security.html)
- [Drupal Patches Highly Critical SQL Injection That Lets Anonymous Attackers Hijack PostgreSQL-Backed Sites](https://www.cyberkendra.com/2026/05/drupal-patches-highly-critical-sql.html)
- [Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation](https://www.securityweek.com/drupal-to-patch-highly-critical-vulnerability-at-risk-of-quick-exploitation/amp/)
- [Drupal Core Vulnerability PSA-2026-05-18 (UC Berkeley ISO)](https://security.berkeley.edu/news/drupal-core-vulnerability-psa-2026-05-18)
- [Apply Updates for Drupal Core Security Release May 20, 2026 (University of Michigan Safe Computing)](https://safecomputing.umich.edu/security-alerts/apply-updates-drupal-core-security-release-may-20-2026)
- [Drupal Highly Critical Security Release Planned for 20 May 2026 Across Supported Core Branches](https://www.thedroptimes.com/69807/drupal-highly-critical-security-release-may-2026)
- [Drupal Core Patch Drops Today: No-Login Flaw Puts Government and University Sites at Immediate Risk](https://www.techtimes.com/articles/316916/20260520/drupal-core-patch-drops-today-no-login-flaw-puts-government-university-sites-immediate-risk.htm)
- [Drupal Security advisories for core (index)](https://www.drupal.org/security/core)
- [CWE-89: Improper Neutralization of Special Elements used in an SQL Command](https://cwe.mitre.org/data/definitions/89.html)
- [MITRE ATT&CK T1190 - Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0542