Quick answers
- Is CVE-2026-56704 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56704 being exploited in the wild.
- How severe is CVE-2026-56704?
- Medium severity, with a CVSS score of 6.1, published 25 August 2026.
- Which products and versions are affected?
- Adminer before 5.4.3.
- Is there a fix for CVE-2026-56704?
- A patch was published on 2026-07-09: Version 5.4.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-56704 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-56704?
- Check whether you run Adminer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in adminer.inc.php line 1081, where the database server version string is inserted directly into a script tag with a valid CSP nonce without sanitization. The vulnerable code uses preg_replace with an insufficient regex pattern that fails to match version strings not starting with digit+dot+digit, causing the original unsanitized string to be returned. An attacker controlling a reachable MySQL server can return a crafted version string (e.g., "1');alert(origin)//") that breaks out of the JavaScript context and executes arbitrary code. The nonce on the script tag bypasses Content Security Policy protections. No authentication is required if combined with login CSRF, as the login form lacks CSRF tokens. The fix is available in version 5.4.3.
Affected products
- Adminer Adminer before 5.4.3
Timeline
- 2026-07-09: disclosed: GitHub security advisory published
- 2026-08-25: disclosed: CVE-2026-56704 published
- 2026-07-09: patched: Version 5.4.3 released with fix