Drupal AI Agents CVE-2026-13237

The CVSS vector PR:N indicates no authentication is required to attempt exploitation. However, AC:H confirms that specific preconditions must be met: the attacker must have prior knowledge of, or be able to enumerate, the internal URL structure of AI agent resources exposed by the module. The vulnerability is contingent on the Drupal AI Agents contributed module being installed, enabled, and running one of the affected version branches (0.0.0-1.1.4, 1.2.0-1.2.5, or 1.3.0-1.3.1). Exploitation is limited by the requirement for resource path knowledge (limiting mass automated scanning), the partial impact scope (no full system access), and the absence of any automatable exploitation path per SSVC. Sites that have not installed this contributed module are entirely unaffected.

Across all available signals, real-world risk is low-to-moderate. The CVSS base score of 4.8 (Medium) is consistent with the vector's AC:H constraint, which limits automated, opportunistic exploitation. EPSS at 0.14% (4th percentile) reflects near-zero observed exploitation probability in threat intelligence feeds. CISA SSVC corroborates this: Exploitation=none, Automatable=no, Technical Impact=partial - all pointing away from urgent triage. There is no KEV listing and no public exploit code identified. The C:L/I:L impact scope means a successful attack results in partial unauthorized data access or modification within the AI Agents module, not full system compromise. The primary concern is Drupal sites that have deployed this contributed module across multiple affected branches, where attackers with knowledge of specific agent resource paths could access or manipulate restricted AI agent data without authorization. The AC:H barrier materially reduces the likelihood of untargeted exploitation. No conflicting signals were identified.

An attacker who identifies a Drupal site running the AI Agents module enumerates or guesses resource URLs associated with AI agent endpoints and sends direct HTTP GET or POST requests to those paths without supplying authorization credentials or tokens. Due to the authorization logic flaw, the module processes the request and returns or modifies restricted AI agent data. No public exploit code exists at time of analysis, and the AC:H constraint means successful exploitation likely requires site-specific path reconnaissance rather than generic scanning.