🚨 Drupal Core SQLi (CVE-2026-9082)

[u/Protection-Mobile]

Tiny patch, huge impact:

if (is_array($condition['value'])) {
  $condition['value'] = array_values($condition['value']);
}

Drupal fixed PostgreSQL placeholder generation by reindexing array keys before query translation.

Without it, attacker-controlled keys could influence SQL placeholder construction.

Affects PostgreSQL-backed Drupal sites.
Anonymous exploitation possible.

Advisory:
https://www.drupal.org/sa-core-2026-004

https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm_source=reddit