Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100697— Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver

Quick assessment

Affected
vrana adminer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Adminer 6.0.0 至 6.0.1 版本中存在一个漏洞。当官方提供的 ClickHouse 驱动插件（文件路径为 plugins/drivers/clickhouse.php，于 6.0.0 版本重写）被加载时，系统容易受到预身份认证状态的服务器端请求伪造（SSRF）攻击。未授权的攻击者可以提交参数 auth[driver]=clickhouse，并将 auth[server] 设置为任意 URL（例如 http://127.0.0.1:18089），从而导致 Adminer 服务器向该目标主机发送包含 '

CVSS 8.6 · High EPSS 0.31% · P22

Affected Version Matrix 2

VendorProduct Version RangeStatus
vrana adminer < 6.0.2 affected
6.0.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100697

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
Source: CVE Program / CVE List V5
Vulnerability Description
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vrana adminer 0 ~ 6.0.2 -

II. Public POCs for CVE-2026-100697

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100697

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100697 (2)

Same Patch Batch · vrana · 2026-09-26 · 4 CVEs total

CVE-2026-100695 6.1 MEDIUM Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
CVE-2026-100696 5.8 MEDIUM Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
CVE-2026-100698 5.8 MEDIUM Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

IV. Related Vulnerabilities

Same product: adminer
Same vendor: vrana
Same weakness: CWE-918

V. Comments for CVE-2026-100697

No comments yet

Leave a comment