CVE-2026-56704: Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Q: Who is exposed to exploitation?

Adminer deployments before 5.4.3 are exposed when they connect to a rogue or attacker-controlled MySQL server. The attacker does not need Adminer credentials according to the supplied vector, but a user must interact with the affected Adminer page.

Q: What must an attacker control to exploit this issue?

The attacker must control a MySQL server that Adminer connects to and make it return a crafted server version string. That string can escape the JavaScript context and execute code despite CSP nonces.

Q: Does Content Security Policy prevent exploitation?

No. The issue specifically involves unsanitized content being inserted into script tags carrying valid CSP nonces, allowing the crafted version string to bypass the intended CSP protection.

Q: What version resolves the issue?

Upgrade Adminer to version 5.4.3 or later. Versions before 5.4.3 are affected.

Published Aug 25, 2026

Updated

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.

Affected Software

1 affected component

Adminer Adminer<5.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Adminer to a version that resolves this vulnerability.
Fixed in 5.4.3

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Adminer deployments before 5.4.3 are exposed when they connect to a rogue or attacker-controlled MySQL server. The attacker does not need Adminer credentials according to the supplied vector, but a user must interact with the affected Adminer page.

What must an attacker control to exploit this issue?

The attacker must control a MySQL server that Adminer connects to and make it return a crafted server version string. That string can escape the JavaScript context and execute code despite CSP nonces.

Does Content Security Policy prevent exploitation?

No. The issue specifically involves unsanitized content being inserted into script tags carrying valid CSP nonces, allowing the crafted version string to bypass the intended CSP protection.

What version resolves the issue?

Upgrade Adminer to version 5.4.3 or later. Versions before 5.4.3 are affected.

CVE-2026-56704: Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What must an attacker control to exploit this issue?

Does Content Security Policy prevent exploitation?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What must an attacker control to exploit this issue?

Does Content Security Policy prevent exploitation?

What version resolves the issue?