Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path
The Drupal Security Team has shipped emergency fixes for a critical remote code execution vulnerability in Drupal core's Field UI module, tracked as CVE-2026-108097 and documented in advisory SA-CORE-2026-014. The flaw was patched on October 14, 2026, in Drupal 11.4.10, 11.3.19, and 10.6.19 (with 12.0.0-beta2 fixing the pre-release 12.x branch). Drupal rates the issue 19 out of 25 on its own risk-scoring scale — the equivalent of "Critical" in Drupal's terminology — though no public CVSS score has been attached to the advisory.
Critically, the Drupal Security Team was explicit that "an attacker cannot reach the flaw through core alone." Field UI ships as part of Drupal's Standard installation profile, meaning most production sites have it enabled by default, but core code alone does not expose a path to trigger the bug. The danger comes from contributed modules (and custom code) that call into Field UI's vulnerable rendering logic — and the advisory states that at least one such contributed-module path requires no authentication at all to exploit. Drupal did not name the specific contributed modules responsible, which means every site running Field UI alongside third-party modules should treat the risk as unconfirmed-but-plausible until patched.
Vulnerability Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-108097 |
| Advisory | SA-CORE-2026-014 |
| Risk Score | 19/25 (Critical) — Drupal's own NIST-derived risk formula; no standard CVSS vector has been published |
| Vulnerable Component | Field UI module (field_ui) — Drupal core, included in the Standard install profile |
| Root Cause | Field UI's pre-render step invoked arbitrary PHP callables via call_user_func_array without validating them first |
| Attack Vector | Not exploitable through Drupal core alone; requires a contributed module or custom code that exposes the vulnerable render path; at least one known contributed-module path needs no authentication |
| Affected Branches | Drupal 11.4.0 up to and including 11.4.9; 11.3.x up to and including 11.3.18; 10.6.x up to and including 10.6.18; 12.0.0-alpha1 through 12.0.0-beta1 |
| End-of-Life, Unpatched | Drupal 11.2.x and earlier, 10.5.x and earlier, Drupal 9, and Drupal 8.9 are also affected but will not receive a fix (EOL) |
| Fixed Versions | 11.4.10, 11.3.19, 10.6.19, 12.0.0-beta2 |
| Release Window | October 14, 2026, 16:00–21:00 UTC, pre-announced October 12 via PSA-2026-10-12 |
| Exploitation Status | No confirmed in-the-wild exploitation at disclosure; the Security Team warned exploits "might be developed within hours or days" |
| Interim Mitigation | Uninstall the Field UI module (field_ui) if you cannot update immediately — admin pages for managing fields become unavailable while it is uninstalled |
| Virtual Patching | Drupal Steward covers known attack vectors for this issue, but does not cover every possible exploitation path |
| Credited Reporters | Drew Webber (Drupal Security Team) and Octavio Galland |
How the Flaw Works
A Pre-Render Callback Executed Without Validation
Field UI provides the administrative screens site builders use to configure fields and manage how they're displayed — the "Manage Fields" and "Manage Display" tabs familiar to anyone who has configured a Drupal content type. According to the Security Team's technical description, the module's pre-render step took "region" values from row data and passed them into call_user_func_array to execute as PHP callables, without first validating that the supplied value was safe to call. In the patched release, that logic was rewritten to read region values directly from the row data rather than executing them as callbacks — removing the arbitrary-code-execution path entirely.
Why Core Alone Isn't Exploitable
The Drupal Security Team's advisory draws a sharp line: the vulnerable code path exists in core, but nothing in core itself supplies the attacker-controlled input needed to reach it. Reaching the flaw requires a second ingredient — a contributed module (or site-specific custom code) that passes externally influenced data into Field UI's vulnerable rendering logic. That is a deliberate design detail in how Drupal assesses and discloses risk: core ships the sink, but something else has to supply the dangerous source. The advisory confirms that multiple contributed modules provide that missing link, and that at least one of those paths can be triggered without authentication — turning a theoretical core bug into a real, remotely exploitable one on affected sites. Drupal has not published the names of the vulnerable contributed modules, consistent with its standard practice of withholding exploit-enabling specifics until patches have had time to propagate.
Exposure Across the Ecosystem
Field UI's inclusion in the Standard install profile means the vulnerable code is present on the large majority of production Drupal sites, whether or not site owners actively use its admin screens. Drupal's own telemetry underscores how much exposure sits on unsupported branches: in the week starting October 4, 2026, 151,442 of the 531,499 sites that reported their core version to drupal.org — roughly 28.5% — were running a branch the advisory lists as affected but that will receive no fix because it is end-of-life. Those sites have no patch path available and must upgrade to a supported major/minor branch before they can remediate.
Other Advisories Released the Same Day
The October 14 security window bundled several additional fixes alongside SA-CORE-2026-014:
- SA-CORE-2026-015 and SA-CORE-2026-016 — moderately critical cross-site scripting issues in core's Link and Navigation components, respectively.
- A cross-site scripting fix in the Gin administration theme.
- A separate critical remote code execution fix for the contributed Entity List module, unrelated to the Field UI issue but released in the same cycle.
None of these carry the same unauthenticated-RCE risk profile as SA-CORE-2026-014, but sites running the affected components should apply all available updates in the same maintenance window.
Impact Assessment
| Impact Area | Description |
|---|---|
| Remote Code Execution | Successful exploitation via a vulnerable contributed module can let an attacker execute arbitrary PHP on the web server hosting the Drupal site |
| Unauthenticated Exposure | At least one contributed-module exploitation path requires no login, removing the usual "attacker needs an account" barrier |
| Ecosystem-Wide Default Exposure | Field UI ships with Drupal's Standard install profile, so the vulnerable code is present on most production sites by default |
| Unpatchable Legacy Installs | Roughly 28.5% of version-reporting sites sit on EOL branches that are affected but will never receive this fix |
| Ambiguous Blast Radius | Drupal has not disclosed which specific contributed modules expose the path, so administrators cannot easily confirm whether their specific module stack is at risk |
| Short Fuse to Exploit Development | The Security Team's own pre-release warning — exploits "might be developed within hours or days" — signals a narrow patching window before weaponization is likely |
Recommendations
For Drupal Site Administrators
- Update immediately to the fixed release for your branch: 11.4.10, 11.3.19, or 10.6.19. Sites on the 12.x pre-release track should move to 12.0.0-beta2.
- If you cannot update right away, uninstall the Field UI module (
field_ui) as an interim mitigation — this removes the vulnerable code path but also disables the "Manage Fields" and "Manage Display" admin screens until you patch. - Inventory every contributed module installed alongside Field UI. Since Drupal has not named the vulnerable contributed modules, treat any module that renders or processes field-display configuration as a candidate and prioritize patching over waiting for module-specific guidance.
- Sites still running Drupal 11.2.x, 10.5.x, Drupal 9, or 8.9 are affected and will not receive a fix — plan an upgrade to a supported branch as the only remediation path.
For Security Teams
- Review web server and PHP error logs for unexpected
call_user_func_arrayactivity or unusual PHP execution tied to Field UI render paths following the October 14 disclosure. - If your organization uses Drupal Steward, confirm coverage status for your site — Steward's virtual patching addresses known attack vectors for this issue but is explicitly not a substitute for applying the core update, since it does not cover every possible exploitation path.
- Treat this release cycle as a full patch sweep: apply fixes for SA-CORE-2026-015, SA-CORE-2026-016, the Gin theme XSS, and the contributed Entity List RCE in the same maintenance window, not just SA-CORE-2026-014.
For Hosting Providers and Agencies
- Proactively notify customers running affected Drupal branches, especially those on EOL versions with no available fix, so upgrade planning starts before exploitation begins.
- For managed Drupal fleets, prioritize patch rollout to internet-facing sites that run third-party contributed modules over internal/staging instances.
Key Takeaways
- CVE-2026-108097 (SA-CORE-2026-014) is a critical Field UI remote code execution flaw in Drupal core, rated 19/25 on Drupal's own risk scale, fixed in 11.4.10, 11.3.19, and 10.6.19 (and 12.0.0-beta2 for the 12.x track).
- Drupal core alone cannot be exploited — the vulnerable
call_user_func_arraycallback in Field UI's pre-render step needs a contributed module or custom code to supply attacker-controlled input. - At least one contributed-module exploitation path requires no authentication, and Drupal has not disclosed which modules are responsible, so affected sites cannot be definitively identified without patching.
- Field UI ships with Drupal's Standard install profile, meaning the vulnerable code is present on the large majority of production sites by default.
- About 28.5% of version-reporting Drupal sites sit on end-of-life branches that are affected but will receive no fix — upgrading to a supported branch is their only remediation path.
- No confirmed in-the-wild exploitation existed at disclosure, but the Drupal Security Team's own pre-announcement warned that exploits could emerge "within hours or days," making prompt patching — or uninstalling Field UI as an interim step — the priority.
Sources
- The Hacker News — Drupal Patches Critical Core RCE Flaw With No-Login Path via Contributed Modules
- Drupal.org — PSA-2026-10-12: Upcoming Critical Drupal Core Release on October 14, 2026
- The Drop Times — Drupal Fixes Two Critical Remote Code Execution Flaws and Three XSS Vulnerabilities
- OSV — DRUPAL-CORE-2026-014