Drupal fixes critical Field UI flaw with unauthenticated code execution path

The Drupal Security Team on October 14, 2026 released fixes for a critical remote code execution flaw in Drupal core's Field UI module. Tracked as CVE-2026-108097 and published in advisory SA-CORE-2026-014, the issue carries a risk score of 19 out of 25. According to the advisory, Drupal core on its own does not directly expose the flaw, but contributed modules create serious exploit paths, and at least one of them does not require authentication.

What happened

The advisory says custom code may also expose the vulnerable functionality. According to The Hacker News, Field UI builds its administration tables from render arrays, and before the fix the table element's pre-render step passed each row's #region_callback value to PHP's call_user_func_array without validating the callable. The publication notes that Drupal's renderer has refused untrusted render callbacks since version 8.8, but the table element's own pre-render method was trusted, so the unchecked callback still ran. The fix stops calling the callback and reads the region value directly.

The vulnerability was reported by Drew Webber of the Drupal Security Team and Octavio Galland. The Hacker News said the Security Team pre-announced the release on October 12 and warned that exploits might be developed within hours or days.

Who is affected

Per the advisory, affected versions are 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, 11.4.0 to before 11.4.10, and 12.0.0-alpha1 to before 12.0.0-beta2. Drupal 8 and 9, as well as 10.5 and earlier and 11.2 and earlier, are end-of-life and receive no fix. The Hacker News, citing drupal.org usage figures, reported that about 28.5 percent of sites reporting to the project were on an affected branch with no available fix.

The same release also fixed CVE-2026-108099, a critical flaw with the same conditions in the contributed Entity List module (fixed in version 3.0.10), which is not updated by a core upgrade. Two moderately critical cross-site scripting flaws in the Link and Navigation core modules, CVE-2026-108515 and CVE-2026-108514, require a logged-in user.

As of October 15, The Hacker News reported no public exploit code and no reports of attacks.

What to do

• Update to Drupal 11.4.10, 11.3.19 or 10.6.19, depending on the branch.
• If an immediate update is not possible, the advisory recommends uninstalling the core field_ui module as temporary protection; the manage fields and manage display pages will be unavailable.
• Sites using Entity List should separately update to 3.0.10.
• Drupal Steward blocks some known attack vectors but not all, the advisory says, so updating remains necessary.
• Sites on end-of-life branches should plan a move to a supported release.