CVE-2026-87936 Drupal CVE debrief

Who should care

Defenders responsible for Drupal deployments using the amazee.ai Private AI Provider module should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure of affected versions, assess SQL injection risk, and apply vendor remediation to prevent potential SQL injection attacks.

Why it matters

Defenders should prioritize verifying exposure of Drupal amazee.ai Private AI Provider versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3, assessing SQL injection risk, and applying vendor remediation to prevent potential SQL injection attacks.

• Verify exposure of affected versions
• Assess SQL injection risk in Drupal deployments
• Prioritize remediation of vulnerable versions

Technical summary

The Drupal amazee.ai Private AI Provider module is vulnerable to SQL injection due to improper neutralization of special elements used in an SQL command. This issue affects versions from 0.0.0 to 1.3.7 and from 1.4.0 to 1.4.3. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise. Defenders should prioritize verifying exposure of affected versions, assessing SQL injection risk, and applying vendor remediation to prevent potential SQL injection attacks.

Defensive priority

Defenders should prioritize verifying exposure of Drupal amazee.ai Private AI Provider versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3, assessing SQL injection risk, and applying vendor remediation.

Recommended defensive actions

• Verify exposure of Drupal amazee.ai Private AI Provider versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3
• Assess SQL injection risk
• Apply vendor remediation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item describe a SQL injection vulnerability in Drupal amazee.ai Private AI Provider versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3. Official sources include the CVE Program record, NVD vulnerability detail, and a Drupal security advisory. The evidence is limited to publicly available information and may not be comprehensive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.