Tiny patch, huge impact:

if (is_array($condition['value'])) {
$condition['value'] = array_values($condition['value']);
}

Drupal fixed PostgreSQL placeholder generation by reindexing array keys before query translation.

Without it, attacker-controlled keys could influence SQL placeholder construction.

Affects PostgreSQL-backed Drupal sites.
Anonymous exploitation possible.

Advisory:
[https://www.drupal.org/sa-core-2026-004\](https://www.drupal.org/sa-core-2026-004)

[https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm\\\_source=reddit\](https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm\_source=reddit)