BuildRiot
Sign in

BackendSource: Drupal

Drupal patches critical Field UI flaw with a known unauthenticated exploit path

Drupal released security updates for CVE-2026-108097 on October 14, 2026. Contributed modules or custom code can expose the Field UI flaw, with at least one known exploit path requiring no login. Drupal core alone is not directly exploitable.

By News DeskPublished here (UTC)2 min read
Drupal logo
Cover: BuildRiot

Drupal released security updates on October 14, 2026, for CVE-2026-108097, a remote code execution vulnerability in its Field UI module. The project rated the flaw Critical, with a Drupal risk score of 19/25. Sources: Drupal

Drupal’s advisory lists patched releases for operators to install. Sources: Drupal

Drupal core alone provides no direct exploit path, but contributed modules can expose the vulnerable functionality through multiple paths, including at least one requiring no authentication. Custom code may also expose it, and the advisory names no affected extensions. Sources: Drupal

Drupal classifies exploitation as “Theoretical” despite identifying known exploit paths. The advisory reports no confirmed attacks; identifying a path does not establish that attackers have used it. Sources: Drupal

Drupal says uninstalling field_ui mitigates the vulnerability while sites are updated. According to Drupal, its Steward service protects against some known vectors but does not cover every possible exploit; Pantheon also highlights that limitation. Sources: Drupal, Pantheon

What to do

  1. Update promptly to a patched release listed in Drupal’s advisory.
  2. If an immediate update is not possible, uninstall field_ui while arranging the update, a mitigation Drupal identifies in its advisory.
  3. BuildRiot recommends verifying the running Drupal version on every deployment after rollout, rather than relying on a changed Composer constraint. Review enabled extensions, including field_ui, and custom code on each deployment. Sources: Drupal

Why it matters

Operators now have specific security updates to deploy. Exposure depends on contributed modules or custom code, and the advisory names no extensions that operators can use as a definitive exposure checklist.

Attribution

Sources

  1. 1DrupalDrupal core - Critical - Remote code execution - SA-CORE-2026-014Source published (UTC)
  2. 2Drupaldrupal 11.3.19Source published (UTC)
  3. 3PantheonDrupal core critical security update (CVE-2026-108097)Source published (UTC)

Read the original source for full details and context.

Report a problem

Links, dates or what you expected. Do not include passwords or private data.

More on Backend

All Backend stories

AI

Google adds QueryData preview to Firestore with MongoDB compatibility

Google announced QueryData support for Firestore with MongoDB compatibility on October 12, 2026. Google says the feature lets developers build data agents that query database content through conversational language. Its documentation says QueryData translates natural-language questions into MongoDB-compatible Query Language (MQL) queries, using developer-supplied context sets with database-specific information. The feature is in preview, with potentially limited support.

Firebase

Backend

KrakenD releases Enterprise 2.13.11 security backport and Community and Enterprise 3.0.1

KrakenD released Enterprise Edition 2.13.11 as a recommended security backport on October 13, 2026, according to its changelog. The changelog also lists Community and Enterprise Edition 3.0.1 releases that day. It says the backport upgrades Go to 1.26.9 and updates amqp and OpenTelemetry dependencies for listed security issues. According to Red Hat, CVE-2026-97032 lets an unauthenticated remote attacker crash Go’s HTTP/2 server if they win an HPACK encoder race. KrakenD says affected versions are exposed when the gateway accepts HTTP/2 through Transport Layer Security negotiation or use_h2c.

KrakenD