CVE-2026-87936 - Vulnerability Details - OpenCVE

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Amazee.ai Private Ai Provider

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-134

History

Thu, 22 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal amazee.ai Private Ai Provider
Vendors & Products		Drupal Drupal amazee.ai Private Ai Provider

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.
Title		amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
Weaknesses		CWE-89
References		https://www.drupal.org/sa-contrib-2026-134

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-22T01:22:05.298Z

Updated: 2026-10-22T17:18:56.762Z

Reserved: 2026-09-09T16:56:20.052Z

Link: CVE-2026-87936

Vulnrichment

Updated: 2026-10-22T17:18:40.871Z

NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:03.033

Modified: 2026-10-22T18:17:31.253

Link: CVE-2026-87936

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87936", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-09-09T16:56:20.052Z", "datePublished": "2026-10-22T01:22:05.298Z", "dateUpdated": "2026-10-22T17:18:56.762Z"}, "containers": {"cna": {"title": "amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134", "datePublic": "2026-09-09T17:14:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-134"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/ai_provider_amazeeio", "product": "amazee.ai Private AI Provider", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/ai_provider_amazeeio", "versions": [{"lessThan": "1.3.7", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "1.4.3", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3."}], "credits": [{"lang": "en", "type": "finder", "value": "Matan Kotick (matank001)"}, {"lang": "en", "type": "remediation developer", "value": "Dan Lemon (dan2k3k4)"}, {"lang": "en", "type": "remediation developer", "value": "Dimitris Spachos (dspachos)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:22:05.298Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T17:18:53.248356Z", "id": "CVE-2026-87936", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T17:18:56.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-87936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T17:18:53.248356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T17:18:40.871Z"}}], "cna": {"title": "amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134", "credits": [{"lang": "en", "type": "finder", "value": "Matan Kotick (matank001)"}, {"lang": "en", "type": "remediation developer", "value": "Dan Lemon (dan2k3k4)"}, {"lang": "en", "type": "remediation developer", "value": "Dimitris Spachos (dspachos)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/ai_provider_amazeeio", "vendor": "Drupal", "product": "amazee.ai Private AI Provider", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.3.7", "versionType": "semver"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.3", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/ai_provider_amazeeio"}], "datePublic": "2026-09-09T17:14:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-134"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:22:05.298Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87936", "state": "PUBLISHED", "dateUpdated": "2026-10-22T17:18:56.762Z", "dateReserved": "2026-09-09T16:56:20.052Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-22T01:22:05.298Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}