Drupal AI Agents CVE-2026-13236

Exploitation requires an authenticated Drupal user account with at least low-level privileges (PR:L per CVSS vector) - this is not an unauthenticated attack. High attack complexity (AC:H) indicates that exploitation is not straightforward: the attacker must identify specific unlinked endpoint paths within the AI Agents module and craft direct HTTP requests to those paths. The Drupal AI Agents module must be installed and enabled on the target site. SSVC's 'Automatable: no' further limits mass exploitation. The vulnerability does not affect Drupal core - only installations where the AI Agents contrib module (any version in the affected ranges) is actively deployed.

The CVSS 3.1 base score of 4.2 (Medium) reflects genuine but bounded risk: AV:N indicates network reachability, but AC:H signals that exploitation is non-trivial and PR:L confirms that a valid authenticated account is required, not a fully unauthenticated attack. S:U and C:L/I:L/A:N together indicate limited blast radius - no scope change, only partial confidentiality and integrity impact, and no availability concern. EPSS of 0.14% at the 4th percentile aligns with very low real-world exploitation probability. SSVC independently corroborates this: exploitation status is 'none', automatable is 'no', and technical impact is only 'partial'. No KEV listing and no public exploit code have been identified. Taken together, these signals consistently point to a low-urgency vulnerability. There are no conflicting signals across the data sources - this is a real but low-priority issue, primarily warranting timely patching rather than emergency response.

An attacker with a valid low-privilege Drupal account on an affected site directly navigates to protected AI Agents module endpoints - bypassing the UI navigation that would normally enforce role-based access - and accesses restricted data or triggers restricted functionality. Exploitation is non-trivial, requiring knowledge of the target endpoint structure and an authenticated session, but no public exploit or proof-of-concept has been identified.