CVE-2026-9082: Drupal Core SQL Injection via PostgreSQL Database Abstraction API

Background

Drupal is one of the most widely deployed content management systems on the internet, particularly in enterprise, government, and higher education contexts. Its database abstraction layer is designed to support multiple database backends — MySQL/MariaDB, SQLite, and PostgreSQL — through a common query API. The abstraction is intended to sanitise inputs consistently regardless of which backend is in use.

CVE-2026-9082 is a SQL injection vulnerability in that abstraction layer, specifically in the code path used when Drupal runs against a PostgreSQL backend. The vulnerability exists in how Drupal constructs certain dynamic queries: under specific conditions, user-supplied data is not properly sanitised before being interpolated into a PostgreSQL query, allowing an attacker to inject arbitrary SQL.

The vulnerability is exploitable without authentication — an attacker with no account on the target Drupal installation can trigger it via the public-facing web interface. CISA added CVE-2026-9082 to the Known Exploited Vulnerabilities catalogue on 22 May 2026 with a federal remediation deadline of 27 May 2026, the shortest standard remediation window CISA issues, indicating assessed high exploitation urgency.

Technical Mechanism

The vulnerability originates in Drupal Core’s PostgreSQL-specific database abstraction code. When building dynamic database queries, Drupal uses a query builder that accepts field names and values as arguments. In the PostgreSQL driver, certain query construction paths concatenate field identifiers into the query string using string interpolation rather than parameterised query placeholders.

Specifically, the flaw occurs when the :: PostgreSQL cast operator or quoted identifiers are processed. The abstraction layer does not canonicalise or escape inputs that contain PostgreSQL-specific syntax before embedding them. An attacker can supply a crafted input containing SQL metacharacters that terminate the intended query and inject an additional SQL statement.

Unlike MySQL, PostgreSQL evaluates stacked queries in certain API contexts and supports COPY TO/FROM STDIN for data exfiltration, making a successful injection with stacked query support both read- and write-capable. The attack requires no elevated privilege — the database connection used by Drupal’s web tier (typically a low-privilege application user) is sufficient to read all tables in the Drupal database, including users_field_data, which stores hashed passwords, email addresses, and user roles.

A successful exploitation chain:

1. Attacker sends crafted HTTP request to an unauthenticated Drupal endpoint that triggers the vulnerable query path
2. Injected SQL appends a secondary query — e.g., SELECT * FROM users_field_data WHERE '1'='1
3. PostgreSQL evaluates both queries; Drupal returns the attacker-controlled subset of results
4. Attacker extracts user table contents including password hashes, emails, and session data
5. With write access or user table data, attacker proceeds to account takeover or further escalation

# CVE-2026-9082 — SQL injection via crafted GET parameter (unauthenticated)
# Payload targets a Drupal view or route that passes field name to the PostgreSQL driver unsanitised

GET /drupal/?q=node&field=title::text%29%3B+SELECT+name%2C+pass%2C+mail+FROM+users_field_data+WHERE+%271%27%3D%271 HTTP/1.1
Host: drupal-site.example.org
Accept: */*

# URL-decoded payload injected into the field identifier:
# title::text); SELECT name, pass, mail FROM users_field_data WHERE '1'='1

# Stacked query variant using PostgreSQL COPY for out-of-band exfiltration
GET /drupal/?q=node&field=title%3A%3Atext%29%3BCOPY+users_field_data+TO+STDOUT+WITH+CSV HTTP/1.1
Host: drupal-site.example.org
Accept: */*

# PostgreSQL cast injection via $$ quoting to bypass simple filters
GET /drupal/?q=api/search&sort=created%24%24%3BSELECT+pg_sleep(5)%3B%24%24 HTTP/1.1
Host: drupal-site.example.org
Accept: */*
# A 5-second delay in response confirms blind injection via time-based technique

The Drupal Security Team rates this vulnerability 20/25 on their internal severity scale, classifying it as Critical.

Real-World Exploitation Evidence

CISA’s addition to the KEV catalogue on 22 May 2026 confirms active exploitation. The short remediation deadline (5 days) is consistent with evidence of active, widespread exploitation rather than limited targeted activity. Shodan and Censys enumeration suggests tens of thousands of internet-facing Drupal installations running PostgreSQL backends, the majority of which are likely unpatched at time of advisory.

Exploitation has been observed in opportunistic scanning campaigns. The vulnerability’s unauthenticated nature makes it suitable for automated exploitation at scale — no site-specific knowledge or pre-existing access is required. Proof-of-concept code circulated in public security research channels within 48 hours of the Drupal Security Advisory.

At time of writing, exploitation is primarily focused on credential extraction (user table dump), with some incidents involving session token theft and subsequent account takeover. Escalation to remote code execution has been documented in environments where the database application user has FILE privilege or where Drupal’s file system configuration exposes writable public paths.

Impact Assessment

• Credential exposure — all user accounts in the Drupal database are accessible, including password hashes, email addresses, and potentially plain-text or reversible credentials in poorly configured installations
• Session token theft — active session tokens stored in the database can be extracted and used to hijack authenticated sessions without requiring password cracking
• Content modification — the write capability allows an attacker to deface content, inject malicious JavaScript into CMS-served pages, or modify data across all content types
• Privilege escalation within Drupal — an attacker can promote their own (or a newly created) account to the administrator role by modifying user role assignments in the database
• Potential RCE — in environments with permissive filesystem configurations, database write access can be leveraged to write PHP webshells to publicly accessible directories, achieving remote code execution
• Downstream data breach liability — Drupal installations frequently store personal data of site visitors and registered users; exploitation constitutes a personal data breach under GDPR and equivalent regulations

Affected Versions

Drupal 9.x reached end of life in November 2023. Installations on Drupal 9 must upgrade to a supported major version to receive patches.

Remediation Steps

1. Update immediately — apply Drupal Core 10.4.6 or 11.1.8:

# Update Drupal Core via Composer
composer update drupal/core-recommended drupal/core-composer-scaffold

# Run database schema updates after code update
vendor/bin/drush updatedb --yes

# Clear all Drupal caches
vendor/bin/drush cache:rebuild

# Verify installed version
vendor/bin/drush core:status | grep "Drupal version"
# Expected: Drupal version: 10.4.6 or 11.1.8

2. Identify PostgreSQL deployments — check settings.php for $databases['default']['default']['driver'] = 'pgsql'; only PostgreSQL backends are confirmed affected
3. Rotate all credentials — after patching, reset all user account passwords, revoke all active session tokens (clear sessions table or increment session cache), and rotate any API keys or third-party integration secrets stored in the database
4. Audit recent database activity — review PostgreSQL query logs for anomalous COPY, UNION, or multi-statement patterns executed under the Drupal database user
5. Inspect for webshells — scan the Drupal web root and all writable directories for unexpected PHP files written after the first confirmed exploitation date (22 May 2026)
6. Disable PostgreSQL FILE privilege — ensure the Drupal database application user does not hold the pg_read_server_files or pg_write_server_files roles; revoke if present
7. Apply WAF rules — as a temporary measure before patching, apply WAF rules blocking SQL injection patterns in request parameters — specifically targeting PostgreSQL metacharacters (::, $$, --) in input fields

Detection Guidance

Look for the following indicators of exploitation in web server logs and database telemetry:

• HTTP requests containing URL-encoded SQL metacharacters in GET/POST parameters: %27, %3B, %2D%2D, UNION, SELECT, ::text, $$
• Unusually large response sizes from Drupal pages that normally return small payloads (suggesting data returned from injected SELECT)
• PostgreSQL pg_log entries showing multi-statement queries or COPY commands executed under the Drupal application database user
• New PHP files appearing in sites/default/files/ or other publicly accessible Drupal directories (webshell placement)
• Drupal watchdog (database log) entries for unexpected account role changes or new user registrations followed immediately by role escalation
• Authentication events from IP addresses that have no prior session history but possess valid session tokens (indicating token theft and replay)

# Splunk SIEM query — detect SQL injection attempts against Drupal (PostgreSQL metacharacters in request params)
index=webserver sourcetype=access_combined cs_host="drupal-site*"
| where match(uri_query, "(%27|%3B|%2D%2D|UNION|SELECT|%3A%3A|%24%24|pg_sleep|COPY\+TO)")
| eval severity=case(
    match(uri_query, "(COPY|pg_read|pg_write)"), "critical",
    match(uri_query, "(SELECT|UNION)"), "high",
    true(), "medium"
  )
| stats count by src_ip, uri_stem, uri_query, severity, _time
| sort -count

# Suricata signature — detect Drupal PostgreSQL SQL injection patterns
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-9082 Drupal PostgreSQL SQLi - Cast Operator Injection"; flow:established,to_server; content:"GET"; http_method; content:".php"; http_uri; pcre:"/[?&][^=]+=.*%3A%3A(text|integer|boolean)/Ui"; sid:9026908; rev:1;)
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-9082 Drupal PostgreSQL SQLi - Stacked Query"; flow:established,to_server; content:"GET"; http_method; pcre:"/[?&][^=]+=(.*%3B|.*%2D%2D|.*UNION|.*SELECT)/Ui"; http_uri; sid:9026909; rev:1;)
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-9082 Drupal PostgreSQL SQLi - Dollar Quoting"; flow:established,to_server; content:"%24%24"; http_uri; content:"drupal"; http_uri; nocase; sid:9026910; rev:1;)

Timeline

References

• NVD — CVE-2026-9082
• CISA KEV — CVE-2026-9082
• Drupal Security Advisory — CVE-2026-9082