Is CVE-2026-92591 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92591 being exploited in the wild.

How severe is CVE-2026-92591?

Medium severity, with a CVSS score of 5.9, published 16 September 2026.

Which products and versions are affected?

Craft CMS 5.0.0 through 5.10.12.

Is there a fix for CVE-2026-92591?

A patch was published on 2026-09-16: Fixed in version 5.10.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92591 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92591?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92591: Craft CMS environment secrets exposure during database outage

CVE-2026-92591 · Severity: medium · CVSS 5.9 · Published 2026-09-16

Craft CMS is a popular content management system that relies on a MySQL database to operate. When the database becomes unavailable while the web server remains running, Craft incorrectly treats this as a sign the system is not yet installed, allowing access to the installer interface. An attacker with a valid guest session cookie from before the outage can request sensitive configuration values—such as security keys, database credentials, and API keys—through this installer, exposing critical secrets that compromise the entire system.

Quick answers

Is CVE-2026-92591 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92591 being exploited in the wild.
How severe is CVE-2026-92591?: Medium severity, with a CVSS score of 5.9, published 16 September 2026.
Which products and versions are affected?: Craft CMS 5.0.0 through 5.10.12.
Is there a fix for CVE-2026-92591?: A patch was published on 2026-09-16: Fixed in version 5.10.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92591 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92591?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from insecure fail-open logic: Craft CMS interprets any database connection failure as proof that the system is uninstalled, enabling the installer actions on already-installed production systems. The install/validate-site endpoint accepts a site name parameter, passes it through Site::getName() for serialization, and expands ${VARIABLE} expressions using App::env(), exposing environment variables, PHP constants, and Craft configuration. An unauthenticated attacker requires three preconditions: a guest CSRF session cookie obtained before the database outage, a matching CSRF token, and knowledge of a predictable variable name (e.g. CRAFT_SECURITY_KEY). The attack vector is network-based but has high attack complexity because it depends on an independently occurring database failure—the vulnerability provides no mechanism to trigger it. The patch (version 5.10.13 and later) treats database errors as an indeterminate state and stops expanding environment expressions in installer input.

Affected products

Craft CMS 5.0.0 through 5.10.12

Timeline

2026-09-16: disclosed
2026-09-16: patched: Fixed in version 5.10.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.