Drupal patches Field UI remote code execution flaw reachable through contributed modules
Drupal shipped fixes on October 14 for CVE-2026-108097, a critical Field UI remote code execution flaw, in 11.4.10, 11.3.19 and 10.6.19. The Security Team says core alone is not reachable, but contributed modules open several paths and at least one needs no login.
The Watch · Security desk
Share graphic: 151,442 of the 531,499 sites that reported their Drupal core version to drupal.org in the week starting October 4, or 28.5%, were on a branch the advisory lists as affected and that received no fix.
- Sites on a branch with no fix, claim 8 151,442 of 531,499 sites 28.5%
Sites on a branch with no fix The whole
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Sites on a branch with no fix | 151,442 sites | 531,499 sites | 28.5% | 8 |
What happened
- The flaw scores 19 of 25 on Drupal's own risk scale, a critical rating by the project's definition.
- The contributed modules that provide a route to the flaw go unnamed in the advisory, and custom code could expose it too.
- No fix is coming for end-of-life versions: Drupal 8 and 9, 10.5.x and earlier, and 11.2.x and earlier.
- Drupal Steward, a web application firewall run by Acquia, Pantheon, Ironstar and Skpr, blocks some known attack vectors but not every possible exploit.
- The advisory listed no public exploit code at publication, and as of October 15 none had surfaced and no attacks using the flaw had been reported.
Why it matters
- Who has to decide decision In the week starting October 4, 151,442 of 531,499 reporting sites (28.5%) ran an affected branch with no fix. Their route is an upgrade, and 11.3.x and 10.6.x targets lose security coverage in December 2026.
- Who's exposed exposure Standard install profile sites have Field UI unless someone removed it. With no module list in the advisory, whether field_ui is installed is the first thing to check.
- What it costs cost A site that cannot update yet can uninstall field_ui, which the advisory says protects it in the interim, but the admin pages for managing fields and their display go dark until the module returns.
Field UI's admin tables are assembled from render arrays, which are PHP arrays that Drupal converts to HTML. Until the fix, pre-rendering the table element meant handing any PHP callable found in a row's #region_callback property to call_user_func_array and executing it unchecked. [15]
Since Drupal 8.8 in 2019, the renderer has declined to execute untrusted render callbacks. Methods belonging to the table element count as trusted, though, so the pre-render step went ahead, and the callable it then invoked was never checked. [16] That call has been present since Drupal 8.9.0 in 2020, if not earlier. [18]
The 11.4.10 code drops the callback. It takes each row's region from that row's own region value; if the value doesn't match a known region, the code substitutes the table's hidden region or its first region. [17] In core, only Field UI's own display forms set the callback. [19] That fits the Security Team's statement that an attacker cannot reach the flaw through core alone. [3]
After the update, a #region_callback that custom code placed on a field_ui_table row will stop running. Pantheon advises sites to review that code and to test the manage fields and manage display pages. [20]
Updating core does not close every path. The Entity List module carries a separate critical remote code execution advisory, CVE-2026-108099, under the same conditions, among them a known route that requires no login. [21] According to its 3.0.10 release note, the fix copies the Field UI change, and a core update leaves the module untouched. [22] Only 90 sites reported using it in the week starting October 4, so most operators can ignore it. A site that runs it needs two updates. [23]
The Security Team pre-announced the release on October 12 and told sites to reserve time "because exploits might be developed within hours or days." [13] The project's May record supports the warning. That month, Drupal saw exploit attempts within two days of advising on a core SQL injection flaw limited to PostgreSQL sites, and CISA put that flaw in its catalog of exploited vulnerabilities. [14]
Two moderately critical cross-site scripting flaws are also fixed in these core releases, one in the Link module (CVE-2026-108515) and one in the Navigation module (CVE-2026-108514). [24] Drew Webber of the Security Team and Octavio Galland are credited with reporting the Field UI flaw. [6]
What to watch
- Whether exploit code or attack reports appear; as of October 15 there were none.
- Whether the Security Team or module maintainers name the contributed modules that open the no-login path.
- Whether CISA adds CVE-2026-108097 to its exploited-vulnerabilities catalog, as it did for the May SQL injection flaw.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption28
- Hype gap−10
- Incentives
- Not scored
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.
- [2]
The flaw is tracked as CVE-2026-108097 and sits in Field UI, the core module behind the admin pages where site builders manage fields and how they display.
- [3]
An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
- [4]
Drupal rates the flaw 19 out of 25 on its own risk scale, the level the project calls critical.
- [5]
The advisory does not name the contributed modules that open a path to the flaw, and custom code may also expose it.
- [6]
Drew Webber of the Security Team and Octavio Galland are credited with reporting the flaw.
- [7]
No fix is available for Drupal 11.2.x and below, 10.5.x and below, and Drupal 8 and 9, all of which are end-of-life.
- [8]
In the week starting October 4, 151,442 of the 531,499 sites that reported their Drupal core version to drupal.org (28.5%) were on a branch that the advisory lists as affected and that received no fix. Both 11.3.x and 10.6.x lose security coverage in December 2026.
- [9]
A site that cannot update yet can uninstall the Field UI module, field_ui, which 'will provide protection while sites are updated,' the advisory says. The admin pages for managing fields and their display are unavailable while the module is uninstalled.
- [10]
Field UI is installed by Drupal's Standard install profile, so a site built from that profile has the module unless someone removed it.
- [11]
Drupal Steward, a web application firewall service with rules written by the Security Team, already blocks some known attack vectors for this flaw. Acquia, Pantheon, Ironstar, and Skpr run it for their customers. It does not cover every possible exploit, and those sites should still update, the advisory says.
- [12]
The advisory rated the flaw as having no publicly available exploit code at the time of publication. As of October 15, none had surfaced, and neither the advisory nor public reports described attacks using it.
- [13]
The Security Team had pre-announced the release on October 12 and told sites to reserve time for it 'because exploits might be developed within hours or days.'
- [14]
In May, Drupal reported exploit attempts within two days of its advisory for a core SQL injection flaw that affected only sites on PostgreSQL, and CISA added that flaw to its catalog of exploited vulnerabilities.
- [15]
Field UI builds its admin tables from render arrays, the PHP arrays Drupal turns into HTML. Before the fix, the table element's pre-render step ran whatever PHP callable each table row carried in its #region_callback property, through call_user_func_array, with no check on what that callable was.
- [16]
Drupal's renderer has refused to run untrusted render callbacks since version 8.8 in 2019. The renderer trusts the table element's own methods, so it ran the pre-render step, and the check never reached the callable that step then executed.
- [17]
The 11.4.10 code no longer calls the callback. It reads each row's region from the row's own region value and uses the table's hidden region, or its first region, when that value is not a known region.
- [18]
The same call had been in the code since at least Drupal 8.9.0 in 2020.
- [19]
In core itself, the callback is set only by Field UI's own display forms.
- [20]
Custom code that set #region_callback on a field_ui_table row will find it no longer runs after the update. Pantheon tells sites to check such code and to test the manage fields and manage display pages after updating.
- [21]
The Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with the same conditions, including a known path that needs no login.
- [22]
The Entity List 3.0.10 release note says the fix mirrors the Field UI change, and updating core does not update the module.
- [23]
In the week starting October 4, 90 sites reported using the Entity List module.
- [24]
The same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514).
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comDrupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.