CVE-2026-56704 in adminer
Summary
by MITRE • 08/25/2026
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Adminer versions prior to 5.4.3 represents a critical Cross-Site Scripting (XSS) flaw rooted in improper input validation during database connection handling. The core technical issue lies in the application's failure to sanitize or encode specific metadata retrieved from the target database server, specifically the version string returned by MySQL-compatible databases. When an administrator connects to a database through Adminer, the software retrieves various diagnostic details about the backend system to display within its interface. In this scenario, the version information is inserted directly into HTML script tags that are protected by Content Security Policy (CSP) nonces. While CSP nonces are designed to restrict the execution of scripts to only those explicitly authorized by the server, they do not inherently prevent data injection if the injected content itself contains valid syntax for a different context or exploits parsing ambiguities within the browser's JavaScript engine.
The operational mechanism of this exploit relies on an attacker controlling a rogue MySQL server that acts as a man-in-the-middle or a deceptive target during the connection process. By configuring their malicious database instance to return a specially crafted version string, the attacker can inject executable JavaScript code into the Adminer interface. Because the script tag already possesses a valid nonce, the browser considers any content within it to be trusted and authorized for execution. The flaw allows the injected payload to break out of its intended data context or exploit specific parsing behaviors in older browsers that fail to properly distinguish between string literals and executable code blocks when special characters are present. This results in the arbitrary execution of JavaScript commands under the security privileges of the Adminer application, effectively bypassing the CSP protections that were meant to mitigate such attacks.
The impact of this vulnerability is severe, as it allows for full client-side compromise within the context of the Adminer web interface. An attacker who successfully exploits this flaw can execute arbitrary scripts in the victim's browser, leading to session hijacking through cookie theft, credential harvesting from stored forms or local storage, and potentially performing actions on behalf of the authenticated administrator. Since Adminer is a database management tool often used with elevated privileges, the ability to inject code provides an attacker with significant leverage to manipulate data, exfiltrate sensitive information, or use the victim's browser as a pivot point for further network attacks. This undermines the integrity and confidentiality assurances provided by both the web application framework and the Content Security Policy implementation.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it relates to stored or reflected XSS depending on how the version string is cached or processed by Adminer. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1059, Command and Control via Application Layer Protocol, where malicious payloads are delivered through legitimate application channels, as well as T1204, User Execution, if the victim is tricked into connecting to a rogue server. The bypass of CSP nonces highlights the importance of defense-in-depth strategies, noting that client-side security controls like CSP should not be relied upon exclusively without robust server-side input validation and output encoding.
To mitigate this vulnerability, administrators must upgrade Adminer to version 5.4.3 or later, where the developers have implemented proper sanitization routines for database metadata before it is rendered in the DOM. Additionally, organizations should enforce strict network segmentation to prevent unauthorized devices from posing as legitimate database servers within their infrastructure. Implementing mutual TLS authentication for database connections can further ensure that clients only communicate with verified and trusted backend services. Regular security audits of third-party web applications are essential to identify such integration flaws where external data sources are treated without sufficient scrutiny, ensuring that the principle of least privilege is maintained across all layers of the application stack.