Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2026-54003

Published Jul 9, 2026 CWE-454

Overview

CVE-2026-54003 is a known-severity vulnerability. It was published on July 9, 2026.

Technical Description

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

GitHub github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d GitHub github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234 GitHub github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b GitHub github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a GitHub github.com/getkirby/kirby/pull/8166 GitHub github.com/getkirby/kirby/releases/tag/4.9.4 GitHub github.com/getkirby/kirby/releases/tag/5.4.4 GitHub github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv

Frequently Asked Questions

What is CVE-2026-54003?

CVE-2026-54003 is a known-severity vulnerability. It was published on July 9, 2026.

How severe is CVE-2026-54003?

CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.

How do I fix or remediate CVE-2026-54003?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-54003?

CyberStrike's AI-powered security agents can automatically detect CVE-2026-54003 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.
Browse by year 2026