CVE-2026-92591: Craft CMS Information Disclosure Vulnerability

CVE-2026-92591 Overview

Craft CMS versions 5.0.0 through 5.10.12 contain a flaw in how the application handles database connection failures. When the configured MySQL endpoint becomes unreachable while PHP remains operational, Craft interprets the failure as an uninstalled state. This exposes anonymous installer actions, including install/validate-site, on production sites during database outages. An unauthenticated attacker holding a pre-outage guest session cookie and matching CSRF token can submit a ${NAME} expression that resolves through App::env(), disclosing environment variables, $_SERVER entries, or PHP constants such as CRAFT_SECURITY_KEY, database credentials, and API keys. The issue is fixed in Craft CMS 5.10.13.

Critical Impact
Unauthenticated disclosure of application secrets, database credentials, and API keys during database outages on unpatched Craft CMS installations.

Affected Products

Craft CMS 5.0.0 through 5.10.12
Craft CMS installations exposing the installer routes
PHP-based deployments with MySQL backends susceptible to connectivity failures

Discovery Timeline

2026-09-16 - CVE-2026-92591 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92591

Vulnerability Analysis

The vulnerability is classified under [CWE-636] (Not Failing Securely). Craft CMS uses the ability to reach its database as the sole signal for determining installation state. When the database connection fails, the application returns to an uninstalled posture and re-exposes anonymous installer endpoints on a live production site.

The reachable install/validate-site action accepts a site name parameter. That value is serialized through Site::getName(), which expands ${NAME} expressions using App::env(). Because App::env() reads process environment variables, $_SERVER entries, and defined PHP constants, an attacker can request any known variable name and receive its value in the response.

Exploitation requires a valid guest session cookie and matching CSRF token that were obtained before the outage and remain valid during it. The database outage itself must occur independently; the vulnerability provides no mechanism to induce it. When both conditions align, the attacker can extract Craft's CRAFT_SECURITY_KEY, database credentials, third-party API keys, and other secrets stored in the environment.

Root Cause

The root cause is conflating database unavailability with an uninstalled application state. Craft's install routing logic does not distinguish transient connectivity failures from a genuinely uninitialized deployment, so security-sensitive setup actions become accessible without authentication during outages.

Attack Vector

The attack vector is network-based and requires no privileges beyond a pre-established anonymous session. An attacker who routinely visits the target to collect a guest session and CSRF token can wait for or observe a database outage, then submit a crafted request to install/validate-site supplying a ${CRAFT_SECURITY_KEY} style expression as the site name. The response echoes the resolved value, leaking the secret.

See the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for detailed technical analysis.

Detection Methods for CVE-2026-92591

Indicators of Compromise

Requests to install/validate-site, install/validate-db, or other install/* actions on a production Craft CMS site.
Site name parameters containing ${...} expressions, particularly referencing CRAFT_SECURITY_KEY, DB_PASSWORD, or other environment variable names.
Correlated database connectivity errors in application logs immediately preceding installer route access.
Anonymous sessions issuing installer requests without a corresponding administrative setup workflow.

Detection Strategies

Alert on any HTTP request to /index.php?p=install/* or equivalent installer routes on installed production sites.
Inspect POST bodies to installer endpoints for ${ sequences that indicate environment variable expansion attempts.
Correlate MySQL connection failure events with subsequent 200 responses from installer routes to identify exploitation windows.

Monitoring Recommendations

Ship Craft CMS application logs and web server access logs to a centralized analytics platform for correlation with database health telemetry.
Monitor for repeated failed database connections that coincide with anonymous traffic hitting installer paths.
Track outbound use of secrets such as API keys after suspected disclosure windows to identify secondary abuse.

How to Mitigate CVE-2026-92591

Immediate Actions Required

Upgrade Craft CMS to version 5.10.13 or later across all environments.
Rotate CRAFT_SECURITY_KEY, database credentials, and any API keys stored in the environment if the site experienced database outages while running an affected version.
Block external access to install/* routes at the reverse proxy or web application firewall for all installed production sites.
Review web and application logs for prior requests to installer endpoints containing ${} expressions.

Patch Information

Craft CMS 5.10.13 fixes the issue by no longer treating a database connection failure as an uninstalled state, preventing installer actions from becoming reachable during outages. Refer to the GitHub Security Advisory GHSA-hfjh-gw6x-7pv5 for release details.

Workarounds

Deny requests to installer paths at the web server, reverse proxy, or WAF layer for any environment where Craft is already installed.
Enforce short session lifetimes and rotate CSRF tokens frequently to shrink the window in which pre-outage sessions remain valid.
Improve database availability with connection pooling, retries, and failover to reduce the outage conditions required for exploitation.
Store secrets in a runtime secret manager rather than process environment variables where feasible, limiting the value of App::env() disclosure.

bash

# Example nginx snippet to block installer routes on installed sites
location ~* ^/index\.php.*p=install/ {
    return 404;
}
location ~* ^/install(/|$) {
    return 404;
}