---
id: 4638
title: "CVE-2026-9082: PostgreSQL SQL Injection in Drupal"
cve: CVE-2026-9082
cvss: 9.8
severity: critical
source_domain: yeswehack.com
source_url: "https://www.yeswehack.com/news/cve-2026-9082-postgresql-drupal"
published_at: "2026-05-22 09:11"
tags: ["active-exploitation", "sql-injection", "postgresql", "poc", "patch-analysis", "cve-2026-9082", "drupal"]
phying_url: "https://phying.com/item/4638"
lang: en
---

# CVE-2026-9082: PostgreSQL SQL Injection in Drupal

## Summary

A patch analysis of CVE-2026-9082 (SA-CORE-2026-004): a PostgreSQL-specific SQL injection in Drupal’s entity query subsystem where unsanitised array keys reach SQL, plus PoC paths and the fix.

## Intelligence Metadata

- **Sources:** yeswehack.com
- **CVE:** CVE-2026-9082
- **CVSS:** 9.8
- **Published:** 2026-05-22 09:11
- **Original:** https://www.yeswehack.com/news/cve-2026-9082-postgresql-drupal
- **Phying News:** https://phying.com/item/4638