{"id":"CVE-2026-87951","kind":"vulnerability","aliases":["CVE-2026-87951"],"related":[],"title":"Drupal SAML SSO Service Provider: stored sensitive data retrievable from embedded storage","description":"Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider  allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider  versions: from 0.0.0 to 3.2.0.","summary":"The Drupal SAML SSO - Service Provider module stores sensitive information insecurely, so data embedded in its storage can be retrieved. The sources say the affected versions run from 0.0.0 to 3.2.0 and do not describe which data or how it is reached.","severity":"low","cvss":3.8,"epss":0.00196,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","saml-sso","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal SAML SSO - Service Provider module with `drush pm:list --filter=saml` and compare it to the affected range up to `3.2.0`.","fix":"- unknown","status":"open","published_at":"2026-10-22T02:17:04+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:43:13+00:00","updated_at":"2026-10-25T04:43:13+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:43:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Drupal SAML SSO Service Provider: stored sensitive data retrievable from embedded storage","impact":"medium","summary":"The Drupal SAML SSO - Service Provider module stores sensitive information insecurely, so data embedded in its storage can be retrieved. The sources say the affected versions run from 0.0.0 to 3.2.0 and do not describe which data or how it is reached.","category":"package","nicknames":[],"who_cares":["drupal","saml-sso","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Embedded sensitive data can be retrieved from module storage","analyst_note":"Find the Drupal security advisory for the SAML SSO module to confirm the fixed version, the exact data exposed and the required access.","how_to_check":"- Check the installed version of the Drupal SAML SSO - Service Provider module with `drush pm:list --filter=saml` and compare it to the affected range up to `3.2.0`.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier. The sources do not state which data is exposed or whether a fixed version exists, so a site owner should check the module's release page before deciding. Sites without this module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000594,"input_tokens":3358,"output_tokens":516,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87951':15A,18A '0.0.0':55B,95C '3.2.0':57B,97C 'affect':51B,88C 'allow':81C 'cve':13A,16A 'data':8A,39B,63B,85C 'describ':61B 'drupal':1A,19B,28B,76C 'embed':11A,40B,83C 'host':26B 'inform':36B,73C 'insecur':37B,69C 'issu':87C 'modul':33B 'packag':20B 'provid':5A,32B,80C,92C 'reach':68B 'retriev':9A,46B,82C 'run':53B 'saml':2A,22B,29B,77C,89C 'saml-sso':21B 'say':49B 'self':25B 'self-host':24B 'sensit':7A,35B,72C,84C 'servic':4A,31B,79C,91C 'sourc':48B 'sso':3A,23B,30B,78C,90C 'storag':12A,43B,70C 'store':6A,34B 'version':52B,93C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier. The sources do not state which data is exposed or whether a fixed version exists, so a site owner should check the module's release page before deciding. Sites without this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87951","severity":null,"published_at":"2026-10-22T02:17:04+00:00","modified_at":"2026-10-22T17:17:01+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87951","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87951","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}