Is CVE-2026-118550 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118550 being exploited in the wild.

How severe is CVE-2026-118550?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Drupal AI before 1.4.11, 1.5.0 to before 1.5.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai ECOSYSTEM:introduced=0,fixed=1.4.11|ECOSYSTEM:introduced=1.5.0,fixed=1.5.2.

How is CVE-2026-118550 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118550?

Check whether you run Drupal AI or Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118550: Drupal AI module information disclosure in Search API caching

CVE-2026-118550 · Severity: info · Published 2026-10-30

The Drupal AI module's Search API backend fails to enforce access controls when caching search results, allowing unprivileged users to view titles and metadata from restricted or unpublished content through cached searches. This affects only sites using the deprecated AI Search submodule with specific Search API caching configurations enabled. An attacker must trigger the cache after a privileged user searches for content they can access.

Technologies: Drupal AI, Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-118550 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118550 being exploited in the wild.
How severe is CVE-2026-118550?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Drupal AI before 1.4.11, 1.5.0 to before 1.5.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai ECOSYSTEM:introduced=0,fixed=1.4.11|ECOSYSTEM:introduced=1.5.0,fixed=1.5.2.
Is there a fix for CVE-2026-118550?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai: upgrade to 1.4.11 or later. Until then: Disable Search API result caching by using the default "Search API (none)" cache option on views using the AI Search backend, or migrate to the standalone AI Search module which is the target for all new development and has received the same fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118550 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118550?: Check whether you run Drupal AI or Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai: upgrade to 1.4.11 or later

Disable Search API result caching by using the default "Search API (none)" cache option on views using the AI Search backend, or migrate to the standalone AI Search module which is the target for all new development and has received the same fix.

Technical details

The AI Search submodule backend checks access to individual search results at query time but does not incorporate those access checks into the Search API cache key. This causes cached results from previous searches to bypass per-user access control when served from cache. The vulnerability requires the AI Search submodule to be enabled, a Search API view configured with time-based, tag-based, or time-and-tag-based caching (not the default "none" cache), and a prior search by an authorized user within the cache lifetime.

Affected products

Drupal AI before 1.4.11, 1.5.0 to before 1.5.2

Identifiers

CVE-2026-118550
DRUPAL-CONTRIB-2026-270

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.