Drupal has addressed a critical vulnerability within its Field UI module, which could potentially allow malicious actors to execute code remotely on affected servers. The security patch was released on October 14, 2026, and applies to versions 11.4.10, 11.3.19, and 10.6.19 of Drupal. This flaw is particularly concerning due to its potential exploit paths through contributed modules, some of which do not require user authentication.
Understanding the Vulnerability
The vulnerability, identified as CVE-2026-108097, resides in the Field UI, a core module responsible for managing fields and their display on admin pages. Drupal has rated the issue as critical, scoring it 19 out of 25 on their risk scale. The security advisory did not specify which contributed modules might expose this vulnerability, leaving room for potential exposure through custom code integrations.
Credit for reporting the flaw goes to Drew Webber and Octavio Galland from the Drupal Security Team. Site administrators are urged to update to the fixed versions to mitigate the risk of exploitation.
Recommended Actions for Site Administrators
To protect against this vulnerability, administrators should update their Drupal installations to the latest fixed versions: 11.4.10 for the 11.4.x branch, 11.3.19 for 11.3.x, and 10.6.19 for 10.6.x. For those unable to update immediately, uninstalling the Field UI module provides temporary protection, although it will disable the ability to manage fields and their display.
Security coverage for versions 11.3.x and 10.6.x will end in December 2026, emphasizing the urgency for sites to update promptly. Additionally, Drupal Steward’s web application firewall offers partial protection by blocking known attack vectors.
Details of the Security Patch
The security patch modifies the way Field UI processes admin tables, which were previously vulnerable due to the execution of PHP callbacks without proper validation. The update ensures that the pre-render step no longer calls potentially harmful callbacks, instead using secure methods to determine region values.
In parallel, the Entity List module has been issued its own critical advisory, CVE-2026-108099, which includes similar conditions and requires updates separate from the core module fixes. Other vulnerabilities addressed include cross-site scripting flaws in the Link and Navigation modules, necessitating logged-in user access to exploit.
While Drupal 7 reached its end of life in January 2025, Pantheon continues to support it with Tag1 Consulting, offering a backport of the fix in version 7.107.
Maintaining up-to-date security practices remains a crucial aspect of managing Drupal sites, and administrators are encouraged to prioritize these updates to safeguard their systems against potential threats.
