---
id: "CVE-2026-118551"
kind: "vulnerability"
aliases: ["CVE-2026-118551"]
title: "Drupal AI module: insecure storage lets attackers retrieve embedded sensitive data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-module", "ai-tooling", "drupal", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:20+00:00"
first_seen_at: "2026-10-30T04:28:38+00:00"
updated_at: "2026-10-30T04:29:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118551", "first_seen_at": "2026-10-30T04:28:38+00:00"}]
---

# Drupal AI module: insecure storage lets attackers retrieve embedded sensitive data

The Drupal AI (Artificial Intelligence) module stores sensitive information insecurely, so data embedded for AI use can be retrieved. An attacker who can reach that stored data can read sensitive content the site holds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Drupal AI module (`drush pm:list --filter=ai` or the Extend page) and compare it to the affected range.
- Confirm whether embeddings or AI provider credentials are stored in the site database.

## Fix

- Move the AI module to a version after `1.5.2` or after `1.4.11` on its release line, as the affected range is `0.0.0` to `1.4.11` and `1.5.0` to `1.5.2`. The sources do not name the exact fixed version.

## Timeline

- 2026-10-30T04:28:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118551

## From the sources

Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_