drupal/shield - SA-CONTRIB-2026-248
The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled or indexed by anonymous visitors.
The module doesn't sufficiently limit the number of authentication attempts it will evaluate under the scenario where an anonymous visitor repeatedly submits basic authentication credentials.
This vulnerability is mitigated by the fact that the configured Shield credentials must be guessable — a long, randomly generated password is not practically brute forceable — and by the fact that Shield is intended as a supplementary barrier in front of a site rather than the site's user access control systems.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/shield | < 1.9.0 | 1.9.0 |
| Drupal module | drupal/shield | < 1.9.0 | 1.9.0 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/shield- Disclosed
- 21.10.2026
- Updated
- 22.10.2026 18:07
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2026-248 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/shield
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.