Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100696— Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

Quick assessment

Affected
vrana adminer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Adminer 版本 4.16.0 至 6.0.1 中，其可选的 Elasticsearch 驱动（位于 plugins/drivers/elastic.php）存在一个预认证的服务器端请求伪造（SSRF）漏洞，该漏洞已在 6.0.2 版本中修复。由于 adminer/include/auth.inc.php 在验证用户登录结果之前调用了 Driver::connect() 方法，未认证的攻击者可以通过提交构造的 auth[server]、auth[username] 和 auth[password] 参数，促

CVSS 5.8 · Medium EPSS 0.31% · P22

Affected Version Matrix 2

VendorProduct Version RangeStatus
vrana adminer < 6.0.2 affected
6.0.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100696

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
Source: CVE Program / CVE List V5
Vulnerability Description
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vrana adminer 0 ~ 6.0.2 -

II. Public POCs for CVE-2026-100696

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100696

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100696 (2)

Same Patch Batch · vrana · 2026-09-26 · 4 CVEs total

CVE-2026-100697 8.6 HIGH Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
CVE-2026-100695 6.1 MEDIUM Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
CVE-2026-100698 5.8 MEDIUM Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

IV. Related Vulnerabilities

Same product: adminer
Same vendor: vrana
Same weakness: CWE-918

V. Comments for CVE-2026-100696

No comments yet

Leave a comment