Drupal fixes critical Field UI flaw with a no-login path via add-ons

Drupal fixes critical Field UI flaw with a no-login path via add-ons

14 October 2026: The Drupal Security Team has fixed CVE-2026-108097, a remote code execution flaw in the Field UI module of Drupal core, in releases 11.4.10, 11.3.19 and 10.6.19. The advisory, SA-CORE-2026-014, rates it critical at 19 out of 25 and warns that although core alone cannot be exploited, several serious paths exist through contributed modules and at least one of them needs no login.

Not yet independently verified. Drupal does not name the contributed modules that expose the flaw. The share of sites on unpatched branches comes from press coverage of Drupal.org usage figures and was not checked against Drupal.org. We will update this when it can be confirmed, and remove this note.

Which sites are exposed

Field UI is the core module that gives site builders the screens for adding and arranging fields on content types, and the Standard installation profile switches it on. The advisory lists the affected ranges as:

• 8.9.0 up to, but not including, 10.6.19;
• 11.0.0 up to 11.3.19;
• 11.4.0 up to 11.4.10;
• 12.0.0-alpha1 up to 12.0.0-beta2, a pre-release not meant for production.

Drupal says custom code can expose the vulnerable functionality too, so a site without the contributed modules in question is not safe by default. It does not name the modules. Press coverage puts the share of reporting Drupal sites on a branch with no fix at more than a quarter, a figure we did not check.

No patch for older branches

Only the three current branches get a fix. Drupal 11.2.x and earlier, and 10.5.x and earlier, are end of life and receive nothing; so do Drupal 8 and 9. For a site stuck on one of those, the choice is between an upgrade to a supported minor release and the interim measure the advisory offers: uninstalling the Field UI module, which "will provide protection while sites are updated". Editors lose the field management screens while it is off, but content and the fields themselves stay in place.

Hosts that run Drupal Steward, the security team's web application firewall programme, already block some known attack vectors. The advisory is explicit that this does not cover every possible exploit and that Steward sites should still upgrade soon.

Why the security team warned in advance

According to The Hacker News, the release was announced two days ahead because exploits might be developed within hours or days of the fix. The advisory credits Drew Webber of the Drupal Security Team and Octavio Galland with the report. Its risk score rates exploitation as theoretical at publication. The Hacker News also reports a separate critical advisory for the contributed Entity List module, which a core update does not fix.

We list Acquia, the company founded by Drupal's creator, and our headless CMS platform category lists seven products for teams weighing a move away from a monolithic CMS.

Related on TrustList:

• Next.js 16.4.1 fixes two critical flaws that need no login to exploit
• Attackers exploit SiteGuard WAF flaw that runs commands as root
• CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

Sources

• Drupal Security Team: SA-CORE-2026-014, Drupal core, Critical, Remote code execution, 14 October 2026
• The Hacker News: Drupal patches critical Field UI flaw with unauthenticated RCE path via contributed modules, 15 October 2026