CVE-2026-9082: Mitigating a Critical SQL Injection Vulnerability in Drupal

• Details have emerged regarding a highly complex SQL injection (SQLi) vulnerability that is impacting Drupal core. It is officially tracked as CVE-2026-9082 and detailed in the vendor advisory SA-CORE-2026-004. 
• Unlike traditional SQL injection flaws that target parameter values, this unique vulnerability exploits how PHP array keys are parsed and converted into database placeholder names.
• The vulnerability primarily affects Drupal environments which utilize a PostgreSQL database back end in conjunction with the JSON:API core module, Views exposed filters, or Entity autocomplete endpoints. 
• If the vulnerability is successfully exploited, an unauthenticated attacker could bypass authentication, exfiltrate sensitive data (such as user password hashes), or perform subquery-based blind data extraction.
• Akamai researchers have analyzed the exploit mechanics and confirmed that customers who are using the standard SQL injection risk group in Akamai App & API Protector are actively protected against this threat.

This vulnerability requires a specific environmental stack to be exploitable. You are at risk if your Drupal site uses a PostgreSQL database and relies on the JSON:API, Views, or related routing modules.

Site administrators should immediately cross-reference their current deployments with the official Drupal security advisory (SA-CORE-2026-004) and update their core installations to the designated patch releases across all supported branches (Drupal 10 and 11).

The vulnerable versions include:

• Drupal 11

  • Supported branches: 11.3.x and 11.2.x

  • Retired branches: 11.1.x and 11.0.x

• Drupal 10

  • Supported branches: 10.6.x and 10.5.x

  • Retired branches: 10.4.x through 10.0.x

• Legacy versions (Drupal 8 and 9)

  • Drupal 9: All versions (9.0.x through 9.5.x)

  • Drupal 8: All versions (8.0.x through 8.9.x)

Note: Drupal 7 is structurally different and does not include the JSON:API module in core, meaning that it would not be affected by this specific exploit chain.

Akamai's threat research team has tested known exploit payloads against Akamai App & API Protector. We can confirm that the existing web application firewall (WAF) engine successfully detects and mitigates this vulnerability out of the box. We will continue to monitor this situation for additional information and will make any necessary updates.

Customers who have enabled the SQL injection risk group in block or deny mode are protected from these attacks. The malicious array keys trigger multiple, highly accurate SQLi anomaly and injection rules (including rules 950902, 959073, 981255, and 3000101) upon inspection of the decoded request parameters.

CVE-2026-9082 serves as a stark reminder that application security must account for the entire data lifecycle. This includes not only the data values but also structural elements like array keys.

Although the Akamai App & API Protector SQL injection risk group provides an immediate and robust layer of defense against these attacks, we strongly advise all organizations to apply the official Drupal core updates as part of their critical patch management cycle.

The Akamai Security Intelligence Group will continue to monitor the exploitation landscape surrounding CVE-2026-9082 and provide updates as the situation evolves. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.