CVE-2026-9082Discovered Published
Drupal core: SQL injection on PostgreSQL sites (CVE-2026-9082)
Advisory record · Vendor advisory
Status. Two-tier request-filter comparison against Eden 1.103.0 using a synthetic HTTP fixture.
The vulnerability
Drupal's database abstraction API can process specially crafted anonymous requests as SQL on PostgreSQL-backed sites. The security advisory lists affected and patched versions.
The Eden patch
Tier 1 — declarative policy. Deny all requests under the fixture prefix /api/entity_form/system, including benign requests.
Tier 2 — native Rust module. Match /api/entity_form/system and refuse requests containing a configured marker in the body.
Measured comparison (2026-11-12 UTC)
| Configuration | Benign request | Attack fixture |
|---|---|---|
| Baseline | HTTP 200 | HTTP 200, backend marker recorded |
| Tier 1 route deny | HTTP 403 | HTTP 403 |
| Tier 2 native module | HTTP 200 | HTTP 403, backend marker absent |
Signed module authority
The module was imported for explicit activation. All expected shards acknowledged activation. Reader inspection, a tampered statement and an invalid signature were rejected. After revocation the same request received HTTP 503. Re-approval and reactivation restored HTTP 403.
Test scope
The fixture tests SQL markers in a synthetic HTTP form body. The affected Drupal database path and PostgreSQL behavior remain unverified.
The measurements cover the supplied fixture probes. Alternate routes, encodings, and other bypasses remain untested.