A proof-of-concept exploit has been published for an error-based SQL injection vulnerability in Drupal Core 10.5.5. The flaw, tracked as CVE-2026-9082, affects the JSON:API module when using PostgreSQL as the backend database.
The vulnerability exists because user-controlled JSON:API filter array keys influence SQL query construction. An attacker can inject SQL subqueries through the filter value parameter, extracting database information from error messages. The exploit was tested successfully on Debian Linux with PHP 8.2, Apache, and PostgreSQL 17.
Drupal’s fixed supply of new coins has no bearing on this vulnerability — this is purely a web application security issue. The proof-of-concept uses a CAST-based technique to trigger PostgreSQL error messages that leak query results. It’s a classic error-based injection pattern, but the fact that it exists in core Drupal is concerning given the platform’s widespread adoption.
Sites running Drupal Core 10.5.5 or earlier should update immediately. The vulnerability is exploitable through unauthenticated JSON:API endpoints, making it particularly dangerous for exposed installations. Administrators should check their Drupal core version and apply patches as soon as they become available.
