Insecure Storage of Sensitive Information in Drupal AI
CVE-2026-118551

3.1LOW

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118551?

A vulnerability exists in Drupal AI that permits unauthorized retrieval of embedded sensitive data due to insecure storage practices. This affects several versions of the software, raising concerns over the protection of sensitive user information and necessitating urgent attention for remediation.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-271

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Abhisek Mazumdar (abhisekmazumdar)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.