CVE-2026-56704: Adminer RCE Vulnerability

CVE-2026-56704 Overview

CVE-2026-56704 is a cross-site scripting (XSS) vulnerability in Adminer, a popular PHP-based database management tool. Versions before 5.4.3 insert unsanitized MySQL server version strings into HTML script tags carrying valid Content Security Policy (CSP) nonces. An attacker who controls a rogue MySQL server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code in the user's browser. Because the injected script inherits a valid CSP nonce, the payload bypasses CSP protections designed to block inline scripts. The flaw is tracked under CWE-79.

Critical Impact
Attackers operating a malicious database server can execute arbitrary JavaScript in the Adminer user's browser, hijacking database sessions and bypassing CSP.

Affected Products

Adminer versions prior to 5.4.3
Adminer deployments connecting to attacker-controlled MySQL servers
Web applications embedding vulnerable Adminer builds

Discovery Timeline

2026-08-25 - CVE-2026-56704 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56704

Vulnerability Analysis

Adminer displays the connected database server's version string within the administrative interface. Before version 5.4.3, the application inserts this string into a <script> block that carries a valid CSP nonce without escaping JavaScript-breaking characters. The nonce authorizes the entire script block, so any injected code executes with full CSP approval.

When a user connects Adminer to a MySQL-compatible server, that server returns its version banner during the handshake. Adminer trusts this banner as benign metadata. A rogue server returning a crafted banner containing quote characters, closing tags, or JavaScript operators can terminate the intended string literal and append attacker-controlled statements. Successful exploitation requires user interaction: the victim must connect Adminer to the attacker-controlled server.

Root Cause

The root cause is missing output encoding when embedding server-supplied data into an executable HTML context. Adminer treats the MySQL version string as trusted data and concatenates it into a script tag rather than serializing it as a JSON string or rendering it in a non-executable context. CSP nonces amplify the impact because they grant the injected code the same execution privileges as legitimate inline scripts.

Attack Vector

The attack requires the victim to authenticate Adminer against a MySQL server the attacker controls. Common vectors include phishing users into connecting to a rogue database host, compromising an existing database server, or leveraging misconfigured network paths that redirect connections. Once connected, the attacker's version banner is rendered and executed. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for protocol-level detail.

Detection Methods for CVE-2026-56704

Indicators of Compromise

Adminer sessions connecting to unfamiliar or external MySQL hosts, particularly across the public internet.
MySQL handshake packets containing non-standard characters such as <, >, quotes, or backticks in the server version field.
Browser console errors or unexpected script executions occurring immediately after a database connection in Adminer.
Outbound requests from Adminer users' browsers to unknown domains shortly after login.

Detection Strategies

Inspect MySQL protocol traffic for version banners exceeding the expected format (for example, 8.0.35-log) or containing HTML or JavaScript syntax.
Deploy web application firewall rules that flag anomalous responses from backend database servers to Adminer instances.
Correlate Adminer authentication events with subsequent outbound browser requests to identify session hijacking.
Use endpoint browser telemetry to detect unexpected script execution originating from Adminer pages.

Monitoring Recommendations

Log all outbound database connections initiated from Adminer to non-corporate IP ranges.
Alert on Adminer usage against database hosts not present in an approved allowlist.
Monitor Adminer versions across the estate and flag any instance older than 5.4.3.

How to Mitigate CVE-2026-56704

Immediate Actions Required

Upgrade Adminer to version 5.4.3 or later on every deployment, including bundled and containerized installations.
Inventory all Adminer instances and remove unused or shadow deployments that expose the tool unnecessarily.
Restrict Adminer network egress so it can only connect to approved internal database servers.
Enforce authentication and IP allowlisting in front of Adminer to prevent untrusted users from initiating rogue connections.

Patch Information

The Adminer maintainers addressed the flaw in version 5.4.3 by sanitizing the server version string before rendering it in the interface. Details are provided in the GitHub Security Advisory GHSA-h6jr-7pr6-grgj. Administrators should apply the update or migrate to a patched distribution package.

Workarounds

Block Adminer from initiating connections to database servers outside the trusted network perimeter.
Disable or remove Adminer in environments where it is not actively required.
Educate database administrators to avoid connecting Adminer to untrusted or externally hosted MySQL endpoints.
Place Adminer behind a reverse proxy that enforces strict access controls and TLS termination.

bash

# Example: restrict Adminer container egress to an approved database subnet
iptables -A OUTPUT -o eth0 -p tcp --dport 3306 -d 10.10.20.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 3306 -j DROP