Drupal have released a security update to address a critical severity vulnerability in Drupal Core. An anonymous user could send specially crafted API requests to exploit the vulnerability leading to information disclosure, and in some cases privilege escalation or remote code execution (RCE) .
Affected organisations are strongly encouraged to review the Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 advisory and apply the relevant updates as soon as practicable.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Last edited: 21 May 2026 12:36 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
