Live › vulnerability › CVE-2026-87940
Go to dashboardThe Drupal Key auth module can leave sensitive information in the web browser cache. An attacker who can exploit an incorrectly configured access control setting may be able to read that cached data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Key auth module at version or earlier, where access control is incorrectly configured so that sensitive responses are stored in shared or browser caches. Sites that do not use the Key auth module, or that do not expose sensitive pages through it, are unlikely to be affected. The sources do not give more detail on the exact configuration needed.
2.2.4No product ranges from the sources yet.
drush pm:list --filter=key_auth or in the Drupal admin under Extend; unknown whether other checks apply2.2.4; the first fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-87940")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.