/
← Voltar ao feed
critical exploit público

Drupal Core CVE-2026-9082 JSON:API pre-auth SQL injection actively exploited within days of disclosure

1 fonte(s) · 1 atualização(ões) · publicado 11/06/2026 18:58 · coletado há 1 dia

CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earliest attempts came on May 22, about two days after publication, and no matching activity was seen before disclosure. All 9 IPs targeted only CMS infrastructure and used identical payload sequences, which points to a shared scanner or exploit kit. F5 expects this early scanning to grow into a larger campaign.

Technical Details

  • The flaw is in how JSON:API handles the filter[name][condition][value] parameter. The array key is not sanitized before it is used in SQL, so injection happens through the key rather than the value. This is a vector many input validators miss.
  • JSON:API is enabled by default in Drupal 8.x and later. Any internet-facing instance on an affected version is exposed, from 8.9.0 through the 10.4.x, 10.5.x, 10.6.x, 11.1.x, 11.2.x and 11.3.x branches. Exploitation allows reading arbitrary database contents, including credentials, session tokens and configuration data.
  • Scanners cycle through /jsonapi/node/article, /jsonapi/node/page and /jsonapi/node/basic_page. Each source sends four requests per content type:
    • a baseline request using the canary values CVE20269082a, CVE20269082b and CVE20269082c;
    • a boolean-based blind SQLi TRUE test;
    • a boolean-based blind SQLi FALSE test;
    • a PostgreSQL time-based test using pg_sleep(5), ::text and chr(49).
  • Evasion techniques include /**/ comment space substitution, nested parentheses and PostgreSQL-specific casting and character functions.
  • Requests use GET with Accept: application/vnd.api+json and a spoofed Chrome User-Agent. This suggests the author tested against a real Drupal instance or adapted a mature exploit template.
  • The top source, 38.15.158.10, used all four variants. 58.252.113.136 concentrated on the PostgreSQL time-based variant to fingerprint database backends.
  • The report also includes the May 2026 top-10 CVE table from F5's honeynet. CVE-2024-4577, CVE-2017-9841 and CVE-2018-20062 hold the top three positions. CVE-2024-44000, CVE-2016-4800 and CVE-2007-6672 are new entries.

Remediation

  • Patch Drupal Core to 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 or 11.3.10, as applicable. Treat unpatched systems as potentially compromised and review them forensically.
  • Audit JSON:API logs for SQL keywords (OR, SELECT, pg_sleep, CASE WHEN) in filter array keys, and for the canary strings CVE20269082a/b/c.
  • Deploy WAF rules for /**/ comment evasion, pg_sleep, nested parentheses in filter array keys, and UNION/SELECT/CASE WHEN in filter values.
  • Block the nine observed source IPs.
  • Disable JSON:API or restrict it to authenticated users if public access is not required.
  • Review database privileges: the pg_sleep() and system catalog access of the PostgreSQL user, and the FILE privilege on MySQL/MariaDB.
  • Monitor for new scanning sources and use behavioral detection, since signature blocking alone may not be enough.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-9082. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52608 ↗ · aplicação web · php · pub. 01/06/2026 não verificado

    Drupal Core 10.5.5 - Error-Based SQL Injection

    This script targets Drupal Core 10.5.5 running on PostgreSQL, abusing the JSON:API module's filter handling, where user-supplied array keys end up inside the SQL query. An unauthenticated remote attacker who can reach a site with JSON:API exposed could trigger database errors that leak data, such as the database version, in the error message. It is a short proof of concept that only demonstrates information disclosure through error-based injection, with no further exploitation. It was tested only in a local Docker setup and is not verified by Exploit-DB, but it appears to match the listed CVE.

    CVE-2026-9082 · autor: cardosource · explicação gerada por IA

Linha do tempo

  1. f5.com ↗ · pub. 11/06/2026 18:58 · coletado 19/10 18:02 primeiro registro

    Drupal Core CVE-2026-9082 JSON:API pre-auth SQL injection actively exploited within days of disclosure

    ler a análise desta fonte

    CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earliest attempts came on May 22, about two days after publication, and no matching activity was seen before disclosure. All 9 IPs targeted only CMS infrastructure and used identical payload sequences, which points to a shared scanner or exploit kit. F5 expects this early scanning to grow into a larger campaign.

    Technical Details

    • The flaw is in how JSON:API handles the filter[name][condition][value] parameter. The array key is not sanitized before it is used in SQL, so injection happens through the key rather than the value. This is a vector many input validators miss.
    • JSON:API is enabled by default in Drupal 8.x and later. Any internet-facing instance on an affected version is exposed, from 8.9.0 through the 10.4.x, 10.5.x, 10.6.x, 11.1.x, 11.2.x and 11.3.x branches. Exploitation allows reading arbitrary database contents, including credentials, session tokens and configuration data.
    • Scanners cycle through /jsonapi/node/article, /jsonapi/node/page and /jsonapi/node/basic_page. Each source sends four requests per content type:
      • a baseline request using the canary values CVE20269082a, CVE20269082b and CVE20269082c;
      • a boolean-based blind SQLi TRUE test;
      • a boolean-based blind SQLi FALSE test;
      • a PostgreSQL time-based test using pg_sleep(5), ::text and chr(49).
    • Evasion techniques include /**/ comment space substitution, nested parentheses and PostgreSQL-specific casting and character functions.
    • Requests use GET with Accept: application/vnd.api+json and a spoofed Chrome User-Agent. This suggests the author tested against a real Drupal instance or adapted a mature exploit template.
    • The top source, 38.15.158.10, used all four variants. 58.252.113.136 concentrated on the PostgreSQL time-based variant to fingerprint database backends.
    • The report also includes the May 2026 top-10 CVE table from F5's honeynet. CVE-2024-4577, CVE-2017-9841 and CVE-2018-20062 hold the top three positions. CVE-2024-44000, CVE-2016-4800 and CVE-2007-6672 are new entries.

    Remediation

    • Patch Drupal Core to 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 or 11.3.10, as applicable. Treat unpatched systems as potentially compromised and review them forensically.
    • Audit JSON:API logs for SQL keywords (OR, SELECT, pg_sleep, CASE WHEN) in filter array keys, and for the canary strings CVE20269082a/b/c.
    • Deploy WAF rules for /**/ comment evasion, pg_sleep, nested parentheses in filter array keys, and UNION/SELECT/CASE WHEN in filter values.
    • Block the nine observed source IPs.
    • Disable JSON:API or restrict it to authenticated users if public access is not required.
    • Review database privileges: the pg_sleep() and system catalog access of the PostgreSQL user, and the FILE privilege on MySQL/MariaDB.
    • Monitor for new scanning sources and use behavioral detection, since signature blocking alone may not be enough.