News Vulnerabilities & Zero-Days

Drupal fixes critical Field UI RCE flaw reachable without login through contributed modules

Drupal released fixes on 14 October 2026 for CVE-2026-108097, a critical remote code execution flaw in core's Field UI module. Core alone does not expose it, but at least one known exploit path through a contributed module requires no authentication.

Published Updated
Illustration of a modular website built from stacked blocks, with one admin panel block cracked open and glowing.

Key takeaways

  • CVE-2026-108097 is a critical remote code execution flaw in Drupal core's Field UI module.
  • Core alone does not expose it, but one known path through a contributed module needs no login.
  • Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19; end-of-life branches get no fix.
  • Uninstalling field_ui protects sites until they can update.
  • The Entity List module has a matching critical flaw that needs its own update.

The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026, fixing CVE-2026-108097, a remote code execution flaw in Drupal core's Field UI module. Drupal rates it 19 out of 25, which it classes as critical.

What is the vulnerability? #

The advisory says the flaw is not directly exploitable with core alone, but there are multiple serious exploit paths involving contributed modules, and custom code may also expose it. At least one known path does not require authentication. The advisory does not name the contributed modules.

The Hacker News reports the cause: Field UI's table pre-render step called a PHP callback set on each row without validating it, bypassing the check Drupal's renderer has applied to untrusted callbacks since version 8.8.

Which versions are affected? #

Drupal branch Affected Fixed in
11.4.x Before 11.4.10 11.4.10
11.3.x 11.0.0 to before 11.3.19 11.3.19
10.6.x 8.9.0 to before 10.6.19 10.6.19
12.0.0 pre-release Before 12.0.0-beta2 12.0.0-beta2

Drupal 11.2.x and earlier, 10.5.x and earlier, and Drupal 8 and 9 are end of life and get no fix. The Hacker News, citing drupal.org usage statistics, reports that 151,442 of 531,499 reporting sites, about 28.5%, were on an affected branch with no fix in the week starting 4 October.

Is it being exploited? #

The Hacker News reported no public exploit code and no reported attacks as of 15 October. The Security Team pre-announced the release on 12 October and warned that exploits could appear within hours or days.

Are any contributed modules affected directly? #

Yes. The Entity List contributed module has its own critical remote code execution flaw, CVE-2026-108099 (SA-CONTRIB-2026-218), with the same conditions, including a known path without login. It is fixed in Entity List 3.0.10. Updating Drupal core does not update the module.

What should Drupal site owners do? #

  1. Update to 11.4.10, 11.3.19 or 10.6.19.
  2. If you cannot update yet, uninstall the core Field UI module (field_ui). The advisory says this protects sites until they are updated; the manage fields and manage display pages become unavailable while it is off.
  3. If you use Entity List, update it to 3.0.10 separately.
  4. If you run an end-of-life branch, plan an upgrade to a supported release. Drupal Steward gives only partial protection, the advisory says.

Sources

  1. Drupal security advisory SA-CORE-2026-014, Drupal Security Team

Questions this raises

Is my site vulnerable if I only use Drupal core?
The advisory says core alone is not directly exploitable, but contributed modules and custom code can expose the flaw. Update regardless.
What if I cannot update right away?
Uninstall the core Field UI module (field_ui). The advisory says this protects sites until they are updated.
Is it being exploited?
No attacks or public exploit code had been reported as of 15 October 2026, according to The Hacker News.

VulnerabilityApplication SecurityOpen Source SecuritySecurity UpdateDrupal