CVE-2026-9082 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Drupal sites for it with a live exploit check.
Detects Drupal core sites on PostgreSQL whose entity query builder lets an anonymous visitor write SQL. When a query filters a text field against a list of values, the PostgreSQL code path names each database parameter after the array KEY the request supplied, and then binds only the values. A key chosen to close the list and continue the statement is therefore copied into the query as SQL. The driver emulates prepared statements, so it stops reading a parameter name at the first punctuation character and the statement still prepares cleanly, which is what makes the injection reliable rather than a syntax error. JSON:API, enabled on most Drupal sites that serve a decoupled front end, passes those request-supplied keys through untouched on a read any anonymous visitor may perform. The verifier sends three requests that differ only in that one array key: a plain key returns no rows, a key carrying a multiplication this scan invented returns rows, and the same key with the product off by one returns no rows again. Only a database that parsed and evaluated the injected arithmetic can produce that pattern, so the finding is the injection firing and not a filter being ignored. The probe evaluates arithmetic only and writes nothing, but the same entry point accepts subqueries, so treat every row in the database as readable. CVSS 9.8, CISA KEV, exploited in the wild within two days of disclosure. Upgrade to Drupal 11.3.10, 11.2.12, 10.6.9, 10.5.10 or 10.4.10 (SA-CORE-2026-004).
Is your app exploitable through CVE-2026-9082?
Scan your domain free