{
  "id": 14693110,
  "title": "Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules",
  "url": "https://urgent.news/2026/10/15/drupal-patches-critical-core-rce-flaw-with-no-login-path-via",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T12:07:20.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html"
  },
  "original_language": "en",
  "account": "A critical core vulnerability in Drupal's Field UI module has been patched with a no-login path through contributed modules. The flaw, tracked as CVE-2026-108097, allows an attacker to execute code on the site's server. Fixed in Drupal 11.4.10, 11.3.19, and 10.6.19 on October 14, the flaw resides in the Field UI module, which manages site fields and display. Drupal rates the risk at 19 out of 25, classified as critical. It's unclear if specific contributed modules exploit the flaw, and custom code could also expose it. Sites running 11.3.x and 10.6.x lose security coverage in December 2026. While 28.5% of reported sites were affected in the week of October 4, 151,442, updating the Field UI module provides protection. Drupal Steward, a web application firewall service, already blocks known attack vectors, but sites should still update. As of October 15, no publicly available exploit code has surfaced. The flaw's root cause lies in Field UI's render system, which prior to version 8.8 in 2019, allowed untrusted render callbacks to run. The 11.4.10 release no longer calls the problematic callback. Custom code that set the #region_callback on a field_ui_table row will find it no longer runs after the update. Separately, the Entity List module also received a critical remote code execution advisory, CVE-2026-108099, sharing the same conditions and fix as Field UI. Drupal 7, which reached end-of-life in January 2025, received a backport of the fix via Drupal 7.107 with Tag1 Consulting.",
  "summary": "Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}