CVE-2026-54003

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54003", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T16:34:11.635Z", "datePublished": "2026-07-09T18:36:43.667Z", "dateUpdated": "2026-07-09T19:23:24.078Z"}, "containers": {"cna": {"title": "Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header", "problemTypes": [{"descriptions": [{"cweId": "CWE-454", "lang": "en", "description": "CWE-454: External Initialization of Trusted Variables or Data Stores", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv"}, {"name": "https://github.com/getkirby/kirby/pull/8166", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/pull/8166"}, {"name": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d"}, {"name": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234"}, {"name": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b"}, {"name": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a"}, {"name": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/4.9.4"}, {"name": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/5.4.4"}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"version": "< 4.9.4", "status": "affected"}, {"version": ">= 5.0.0, < 5.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-09T18:36:43.667Z"}, "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4."}], "source": {"advisory": "GHSA-whxw-24jc-cwmv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T19:23:16.615569Z", "id": "CVE-2026-54003", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T19:23:24.078Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54003", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T19:23:16.615569Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T19:23:19.357Z"}}], "cna": {"title": "Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header", "source": {"advisory": "GHSA-whxw-24jc-cwmv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}], "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv", "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkirby/kirby/pull/8166", "name": "https://github.com/getkirby/kirby/pull/8166", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d", "name": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234", "name": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b", "name": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a", "name": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "name": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "name": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-454", "description": "CWE-454: External Initialization of Trusted Variables or Data Stores"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-09T18:36:43.667Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54003", "state": "PUBLISHED", "dateUpdated": "2026-07-09T19:23:24.078Z", "dateReserved": "2026-06-11T16:34:11.635Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-09T18:36:43.667Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de la versi\u00f3n 4.9.4 y desde la 5.4.4, los sitios de Kirby sin cuentas de usuario configuradas que se ejecutan en servidores de acceso p\u00fablico detr\u00e1s de un proxy inverso que establece el encabezado de solicitud Forwarded, X-Client-IP o X-Real-IP podr\u00edan permitir a atacantes remotos instalar el Panel y crear el primer usuario administrador porque las comprobaciones de IP local confiaban incorrectamente en esos encabezados. Este problema est\u00e1 solucionado en las versiones 4.9.4 y 5.4.4."}], "id": "CVE-2026-54003", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54003", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T19:23:16.615569Z", "version": "2.0.3"}}]}, "published": "2026-07-09T19:17:06.120", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/pull/8166"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/releases/tag/4.9.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/releases/tag/5.4.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-454"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kirby", "source": "cna", "vendor": "getkirby"}, "product": "kirby", "vendor": "getkirby"}], "created": "2026-07-09T20:45:03.719464+00:00", "updated": "2026-08-01T14:15:03.798931+00:00", "vendors": ["getkirby", "getkirby$PRODUCT$kirby"]}