Drupal — Critical Core RCE Flaw Patched with No-Login Path via Contributed Modules (CVE-2026-108097)

Publication date: October 15, 2026
Category: Vulnerability / Web Security

Introduction

The Drupal Security Team has issued critical security advisories and patches across multiple branches of its content management system. The primary vulnerability, tracked as CVE-2026-108097, resides within the Field UI core module. This flaw allows a remote attacker to achieve arbitrary Remote Code Execution (RCE) on the underlying web server. Although Drupal core cannot be exploited directly on its own, several exploit paths exist through contributed modules, including at least one critical pathway requiring zero authentication. The issue was jointly reported by Drew Webber of the Drupal Security Team and Octavio Galland.

What is the Field UI Module and the Code Execution Vulnerability? (General Analysis)

Drupal relies heavily on a flexible modular architecture. The Field UI module (field_ui) is the core component that drives administrative pages where site builders manage fields and their display settings. Because it is included in Drupal’s standard installation profile, it is active by default across a vast portion of web deployments worldwide.

Drupal rates this flaw as 19 out of 25 on its internal risk scale, designating it as critical. Since official National Vulnerability Database (NVD) entries were not yet published at the time of writing, the following technical vector parameters represent a reasoned estimation based on the vulnerability description:

  • Primary CVE: CVE-2026-108097
  • Estimated CWE Classification: CWE-94 (Control Generation of Code / Code Injection) or CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).
  • Estimated CVSS v3.1: 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The overarching risk stems from the ability of unauthenticated threat actors to fully compromise the underlying web infrastructure, establish persistence, and seize absolute control over hosted assets.

How Does It Work? (Technical Analysis)

The technical mechanism behind CVE-2026-108097 exposes a flaw in the internal processing of render arrays—the PHP data structures Drupal translates into structured HTML markup.

  • Initial Entry Flow: The vulnerability originates from how the pre-render step processes tables constructed by Field UI. Previously, table elements executed any PHP callable provided within a row’s #region_callback property via call_user_func_array, entirely bypassing validation on what that callable actually was.
  • Bypass of Prior Security Restrictions: Since version 8.8 introduced in 2019, Drupal’s renderer has refused to execute untrusted render callbacks. However, because the renderer implicitly trusted the table element’s own native methods, it executed the pre-render step directly, meaning safety checks never reached the executed callable.
  • Exploitation via Contributed Modules: Attackers can leverage manipulated inputs through contributed modules (such as the Entity List module vulnerability tracked under CVE-2026-108099) to inject arbitrary execution hooks into render properties, forcing the server to execute malicious code without requiring user credentials.

Affected Systems / Environments

The scope of this vulnerability affects multiple supported Drupal core branches as well as specific contributed modules inheriting the flawed logic.

CVE Category (CWE) Impact CVSS Vector (Resumied)
CVE-2026-108097 CWE-94 (Estimated) Remote Code Execution (Core Field UI) 9.8 (Estimated) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-108099 CWE-94 (Estimated) Remote Code Execution (Entity List Module) 9.8 (Estimated) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-108515 CWE-79 (Estimated) Cross-Site Scripting (Link Module) 6.5 (Estimated) AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-108514 CWE-79 (Estimated) Cross-Site Scripting (Navigation Module) 6.5 (Estimated) AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected Drupal Versions and Patch Status:

  • Drupal 11.4.x: Update immediately to 11.4.10.
  • Drupal 11.3.x: Update immediately to 11.3.19 (security coverage for this branch ends in December 2026).
  • Drupal 10.6.x: Update immediately to 10.6.19 (security coverage for this branch ends in December 2026).
  • Drupal 12.0.0 beta: Update to 12.0.0-beta2 (strictly intended for testing, not for production use).
  • Unpatched / End-of-Life Versions: Drupal 11.2.x and below, 10.5.x and below, alongside Drupal 8 and 9, are unsupported and receive no official fixes.
  • Contributed Modules: The Entity List module requires an independent update to version 3.0.10.

Critical Context Note: Official Drupal usage statistics reveal that over 28% of reporting sites were operating on unpatched, vulnerable branches at the time of disclosure, exposing a massive global attack surface.

Mitigation and Detection

Remediation

  1. Apply Official Patches: Upgrade Drupal core installations and vulnerable contributed modules to their respective secured versions immediately.
  2. Temporary Mitigation (Uninstall Field UI): If an immediate core update is unfeasible, administrators can uninstall the field_ui module. This provides provisional protection while updates are scheduled, though administrative field management pages will remain unavailable.
  3. Review Custom Code: Inspect custom codebases for any implementation of #region_callback within field_ui_table rows, as the 11.4.10 fix intentionally disables the execution of these callbacks.

Detection

  • WAF Monitoring: Web Application Firewall services like Drupal Steward feature defensive rules blocking known attack vectors, though organizations should treat this as defense-in-depth rather than a substitute for patching.
  • Log Analysis: Audit HTTP access logs for suspicious requests targeting administrative field management endpoints paired with unusual parameter payloads indicative of PHP object injection.

Operational Warning: Historically, critical core vulnerabilities in Drupal have witnessed automated exploitation attempts materializing within hours or days of public advisory releases.

Wrapping Up

The disclosure of CVE-2026-108097 highlights the complex risk landscape inherent to modular CMS architectures. The flaw demonstrates how subtle interactions between core rendering engines and contributed extensions can expose unauthenticated remote code execution pathways. Given the substantial volume of legacy and unpatched deployments worldwide, prompt patching, rigorous log monitoring, and proactive mitigation strategies remain essential for defending web infrastructure against exploitation.

References