PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87951 Drupal CVE debrief

The SAML SSO - Service Provider module for Drupal has a vulnerability allowing information disclosure due to insecure storage of sensitive information. This affects versions from 0.0.0 to 3.2.0. Defenders should assess exposure and prioritize verification of deployments, reviewing and updating affected versions to 3.2.0 or later, and monitoring for potential information disclosure. Additional details on exploitation and remediation are limited in the CVE record and source item, requiring further verification.

Vendor
Drupal
Product
SAML SSO - Service Provider
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for SAML SSO - Service Provider deployments, including operators, platform administrators, vulnerability management teams, and security teams, should assess exposure and potential impact. They must prioritize verifying deployments, review and update affected versions, and monitor for information disclosure to mitigate risks effectively.

Why it matters

This vulnerability allows for information disclosure due to insecure storage of sensitive information in the SAML SSO - Service Provider module for Drupal. Defenders should prioritize verifying exposure and assessing potential impact on deployments.

  • Verify exposure and assess potential impact on SAML SSO - Service Provider deployments
  • Review and update affected versions to 3.2.0 or later
  • Monitor for potential information disclosure

Technical summary

The SAML SSO - Service Provider module for Drupal has an insecure storage of sensitive information vulnerability, allowing information disclosure. Affected versions range from 0.0.0 to 3.2.0. Defenders must prioritize verifying exposure, assess potential impact, and review/update affected versions to 3.2.0 or later. Monitoring for potential information disclosure is crucial.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on SAML SSO - Service Provider deployments.

Recommended defensive actions

  • Verify SAML SSO - Service Provider version and assess exposure
  • Review and update affected versions to 3.2.0 or later
  • Monitor for potential information disclosure

Evidence notes

The CVE record and source item provide details on the vulnerability, with additional information needed on potential exploitation and remediation steps. Defenders should verify exposure, review affected versions, and monitor for information disclosure. Limited details are available, necessitating further defensive review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87951 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87951

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87951 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87951

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.