Live › vulnerability › CVE-2026-118551
The Drupal AI (Artificial Intelligence) module stores sensitive information insecurely, so data embedded for AI use can be retrieved. An attacker who can reach that stored data can read sensitive content the site holds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal AI (Artificial Intelligence) module in the affected version ranges are exposed. Sites without the module, or running versions outside the listed ranges, are not affected. The sources do not say what level of access an attacker needs.
No product ranges from the sources yet.
drush pm:list --filter=ai or the Extend page) and compare it to the affected range.1.5.2 or after 1.4.11 on its release line, as the affected range is 0.0.0 to 1.4.11 and to . The sources do not name the exact fixed version.1.5.01.5.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-118551")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.