PT-2026-28635 · Drupal · Drupal Ai

Abhisek Mazumdar + 7 · CVE-2026-3573 · Published 2026-03-11 · Updated 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.1.10 Drupal AI versions 1.2.0 through 1.2.11

Description An incorrect authorization issue exists in Drupal AI (Artificial Intelligence) that allows for resource injection. The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) allow the use of a Large Language Model (LLM) to generate HTML or Markdown, and preview it in a browser. Under specific conditions, rendering this HTML can expose secret communications related to the LLM request.

Recommendations Update Drupal AI to version 1.1.11 or later. Update Drupal AI to version 1.2.12 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-3573

DRUPAL-CONTRIB-2026-028

Affected Products

Drupal Ai

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3573.json · Exploit
• https://drupal.org/sa-contrib-2026-028 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3573 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3573 · Security Note
• https://drupal.org/project/ai · Note
• https://git.drupalcode.org/project/ai · Note
• https://twitter.com/CVEnew/status/2037280542463512799 · Twitter Post