Read the docs
TI-2026-64852 Aliases CVE-2026-100696GHSA-c9jj-9w3r-2hj8

Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

Priority HIGH 70CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00387 33rd percentileScored 2026-11-07
Fix Fixed adminer (vrana): 6.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admineradminerbefore 6.0.26.0.2Patch availableCNA
  • adminer VendorAdminer Affected before 6.0.2 Fixed in 6.0.2 Patch available CNA

Remediation

  • Fix · CNA adminer (vrana) Fixed in 6.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    vrana adminer 6.0.2

    4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2026-64854 Adminer before 6.0.2 Privileged-Port SSRF via host_port RegexPriority HIGH 70
    • TI-2026-64853 Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driverPriority MEDIUM 63
    • TI-2026-64851 Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCEPriority MEDIUM 57
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100696
  2. 2026-10-03 Alias added: GHSA-c9jj-9w3r-2hj8

References

Advisory 1

  • TI-2021-04411 SSRF in adminer KEVCVSS 3.1HIGH 7.2
  • TI-2026-40884 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-71163 Remote code execution in Adminer via UTF-8 BOM SQLite bypass CVSS 4.0HIGH 8.6
  • TI-2026-40882 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO CVSS 4.0HIGH 8.6
  • TI-2026-64854 Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex CVSS 4.0MEDIUM 6.9
  • TI-2026-40881 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload CVSS 4.0HIGH 7.1
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences