CVE-2026-6366

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

6.6 MediumFix available

CVE-2026-6366 is a medium vulnerability (CVSS 6.6) in Drupal, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in drupal/core 10.1.8.

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.40%Up 0.4 points since May 20, 2026

What each source reports

CVE List Score used 6.6

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: CVE-2026-6366
CVSS 3.1: 6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

EUVDEUVD-2026-30999 6.6

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: EUVD-2026-30999
CVSS 3.1: 6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xmjc-63pr-2mpg 6.6

Drupal core allows Object Injection

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: GHSA-xmjc-63pr-2mpg
CVSS 3.1: 6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record: GHSA-6ccv-8fgf-cjpw
Updated: 2026-11-02

NVD 6.6

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: CVE-2026-6366
CVSS 3.1: 6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

OSV 6.6

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: CVE-2026-6366
CVSS 3.1: 6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

Show 6 moreShow less

OSVGHSA-xmjc-63pr-2mpg 6.6

Drupal core allows Object Injection

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: GHSA-xmjc-63pr-2mpg
CVSS 3.1: 6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

OSVBIT-drupal-2026-6366 No score

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Record: BIT-drupal-2026-6366
Updated: 2026-11-02

OSVCLSA-2026-1783645405 No score

TuxCare security update for drupal/core (2 CVEs)

TuxCare rebuilt drupal/core to address 2 CVEs. Fixed in 9.5.11-p4+tuxcare.

Record: CLSA-2026-1783645405
Updated: 2026-11-02

OSVCLSA-2026-1784682869 No score

TuxCare security update for drupal/core (21 CVEs)

TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.

Record: CLSA-2026-1784682869
Updated: 2026-11-02

OSVDRUPAL-CORE-2026-002 No score

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.

This issue is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

Record: DRUPAL-CORE-2026-002
Updated: 2026-11-02

OSVGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record: GHSA-6ccv-8fgf-cjpw
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`drupal/core` Packagist	8.0.0 up to 10.1.8	10.1.8
`drupal/core` Packagist	10.2.0 up to 10.2.2	10.2.2
`drupal/core` Packagist	8.0.0 up to 10.5.9	10.5.9
`drupal/core` Packagist	10.6.0 up to 10.6.7	10.6.7
`drupal/core` Packagist	11.0.0 up to 11.2.11	11.2.11
`drupal/core` Packagist	11.3.0 up to 11.3.7	11.3.7
`drupal` Bitnami	8.0.0 up to 10.5.9, 10.6.0 up to 10.6.7, 11.0.0 up to 11.2.11, 11.3.0 up to 11.3.7	10.5.910.6.711.2.1111.3.7
`drupal/core` TuxCare:Packagist	9.5.11 up to 9.5.11-p4+tuxcare, plus listed versions 9.5.11-p1+tuxcare9.5.11-p2+tuxcare9.5.11-p3+tuxcare	9.5.11-p4+tuxcare
`drupal/core` TuxCare:Packagist	8.9.20 up to 8.9.20-p1+tuxcare	8.9.20-p1+tuxcare
`drupal/core` Packagist	8.0.0 up to 10.5.9, 10.6.0 up to 10.6.7, 11.0.0 up to 11.2.11, 11.3.0 up to 11.3.7, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less 10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7	10.5.910.6.711.2.1111.3.7

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`drupal/core` Packagist	8.0.0 up to 10.1.8, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less 10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4	10.1.8
`drupal/core` Packagist	10.2.0 up to 10.2.2, plus listed versions 10.2.1	10.2.2
`drupal/core` Packagist	8.0.0 up to 10.5.9, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less 10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7	10.5.9
`drupal/core` Packagist	10.6.0 up to 10.6.7, plus listed versions 10.6.110.6.210.6.310.6.410.6.510.6.6	10.6.7
`drupal/core` Packagist	11.0.0 up to 11.2.11, plus listed versions 11.0.111.0.1011.0.1111.0.1211.0.13 Show 36 moreShow less 11.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.911.1.011.1.0-beta111.1.0-rc111.1.111.1.1011.1.211.1.311.1.411.1.511.1.611.1.711.1.811.1.911.2.011.2.0-alpha111.2.0-beta111.2.0-rc111.2.0-rc211.2.111.2.1011.2.211.2.311.2.411.2.511.2.611.2.711.2.811.2.9	11.2.11
`drupal/core` Packagist	11.3.0 up to 11.3.7, plus listed versions 11.3.111.3.211.3.311.3.411.3.511.3.6	11.3.7

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less

This page doesn't list everything

Left out here: 1,015 versions. The JSON record has them.