Drupal Fixes Critical Field UI RCE Reachable Without Login Through Add-Ons

Drupal released security updates on October 14, 2026, for a critical remote code execution vulnerability in the core Field UI module. Tracked as CVE-2026-108097, the flaw received a Drupal risk rating of 19 out of 25.

Core alone does not provide a route to the vulnerable behavior. However, according to The Hacker News’ account of the Drupal Security Team advisory, several exploitation paths exist through unnamed contributed modules, including at least one that requires no login. Custom code can also expose the flaw.

As of October 15, 2026, no public exploit or reported attack using CVE-2026-108097 had surfaced. Drupal had pre-announced the security release on October 12, warning administrators to reserve time for the update because exploit development could follow within hours or days.

Which Drupal releases need attention

The vulnerability is fixed in the following releases:

Sites using Drupal’s Standard installation profile include Field UI unless administrators have removed it.

Version-reporting data illustrates the potential legacy exposure but does not represent every Drupal installation. During the week beginning October 4, 2026, 151,442 of 531,499 sites that sent their core version to drupal.org—28.5%—were running branches described as affected but no longer receiving a fix.

How the callback escaped Drupal’s render protections

Field UI provides administrative pages used to configure fields and control how they appear. It constructs tables as render arrays, which Drupal later turns into HTML.

Before the patch, the table’s pre-render process accepted the PHP callable stored in each row’s #region_callback property and invoked it through call_user_func_array. The code did not first confirm that the callable was safe.

Drupal’s renderer has blocked untrusted render callbacks since version 8.8. That protection did not cover this indirect execution path: the renderer trusted the table element’s own pre-render method, while the callable subsequently selected from #region_callback was not subjected to the same validation.

If a contributed module or custom implementation allows attacker-controlled data to reach that property, the result can be arbitrary PHP execution. The vulnerable call had been present since at least Drupal 8.9.0.

In Drupal 11.4.10, the table code no longer executes the row callback. Instead, it obtains the region directly from the row’s region value. An unrecognized value is replaced by the table’s hidden region or, if that is unavailable, its first region.

That change also has a compatibility consequence. Custom code that assigns #region_callback to rows in a field_ui_table will no longer see those callbacks executed after the update. In core, Field UI’s own display forms were the only components using that property.

Update first; disabling Field UI is temporary protection

Administrators should install the fixed release for their supported branch. If an immediate upgrade is not possible, the advisory recommends uninstalling the Field UI module, identified as field_ui, while the site is being updated.

Removing the module blocks the vulnerable component but also makes the administrative “manage fields” and “manage display” pages unavailable.

Drupal Steward, a web application firewall ruleset maintained by the Security Team, already blocks some known attack vectors. Acquia, Pantheon, Ironstar, and Skpr operate it for their customers. Its coverage is incomplete, however, so it is not a substitute for upgrading.

After applying the update, operators with custom Drupal code should:

• Search for code that sets #region_callback on field_ui_table rows.
• Test the “manage fields” and “manage display” administration pages.
• Replace any workflow that depended on the now-disabled row callback behavior.

Entity List requires a separate module update

The same release window included CVE-2026-108099, a critical RCE issue in the contributed Entity List module. Its reported conditions also include a known path that requires no authentication, and the release notes for Entity List 3.0.10 say its correction mirrors the Field UI change.

Updating Drupal core does not update Entity List. Sites using that module must upgrade it separately to 3.0.10. During the week beginning October 4, 2026, 90 sites reported using the module.

The patched core releases also address two moderately critical cross-site scripting flaws: CVE-2026-108515 in the Link module and CVE-2026-108514 in the Navigation module. Both require at least a logged-in user.

Drupal 7 is end-of-life on drupal.org and has no official core fix listed. Pantheon says its long-term support service with Tag1 Consulting has released Drupal 7.107 with a backport of the correction. Operators relying on that service should use the supported build provided through it.