CVE-2026-100696: Adminer SSRF Vulnerability in Elasticsearch

CVE-2026-100696 Overview

CVE-2026-100696 is a pre-authentication Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Adminer, a popular PHP-based database management tool. The flaw affects Adminer versions 4.16.0 through 6.0.1 and is fixed in 6.0.2. It resides in the optional Elasticsearch driver (plugins/drivers/elastic.php) and is reachable without authentication because adminer/include/auth.inc.php invokes Driver::connect() before login validation. An unauthenticated attacker can force the Adminer server to issue HTTP GET requests to arbitrary reachable hosts and ports, enabling internal network reconnaissance.

Critical Impact
Unauthenticated attackers can abuse the Elasticsearch driver to scan internal networks, fingerprint services, and leak selected JSON error fields through the login page.

Affected Products

Adminer 4.16.0 through 6.0.1 (Elasticsearch driver enabled)
Deployments using the adminer/elastic.php template
Custom builds registering the Elasticsearch driver via adminer_object()

Discovery Timeline

2026-09-26 - CVE-2026-100696 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100696

Vulnerability Analysis

Adminer's authentication flow calls the database driver's connect() method before validating user-supplied credentials. When the Elasticsearch driver is loaded, this connect() call issues an outbound HTTP GET request using get_url() and file_get_contents() against a host and port derived from attacker-controlled auth[server], auth[username], and auth[password] parameters.

The driver performs only general syntax validation on the server value. It does not block loopback (127.0.0.0/8), private (RFC 1918), link-local (169.254.0.0/16), or other reserved address ranges. When no port is specified, the driver appends the default Elasticsearch port 9200. Adminer's generic port filter rejects ports below 1024, but all higher ports remain reachable.

Selected JSON error fields from non-2xx Elasticsearch-style responses, along with connection failure messages, are rendered back on the login page. This creates a port-scanning oracle useful for internal service enumeration and fingerprinting.

Root Cause

The root cause is a sequencing flaw: the driver's connection logic executes before credential validation, and the Elasticsearch driver lacks SSRF defenses against reserved address ranges. The vulnerability also depends on PHP's allow_url_fopen being enabled, which permits file_get_contents() to perform remote HTTP requests.

Attack Vector

An attacker submits a crafted login form to the Adminer endpoint, setting auth[server] to any reachable internal host and optional port. The Adminer process issues an HTTP GET to that endpoint and reflects response details back to the attacker. Exploitation requires that the optional Elasticsearch driver be explicitly deployed, since it is not included in the default build.

// Vulnerability flow (prose description - no verified PoC available)
// 1. Attacker POSTs login form with auth[server]=10.0.0.5:8080
// 2. auth.inc.php calls Driver::connect() prior to login validation
// 3. Elasticsearch driver issues GET http://10.0.0.5:8080/ via file_get_contents()
// 4. Response status, JSON error fields, or connection failure reflected on login page

Detection Methods for CVE-2026-100696

Indicators of Compromise

Outbound HTTP GET requests from the Adminer web server to internal or reserved IP ranges on arbitrary ports at or above 1024.
Repeated POST requests to the Adminer login endpoint containing varying auth[server] values pointing to internal hostnames or IPs.
Web server logs showing failed authentication attempts correlated with outbound connection attempts to port 9200 or other service ports.

Detection Strategies

Inspect web access logs for POST requests to Adminer with auth[server] parameters containing IP literals, especially RFC 1918 or loopback addresses.
Correlate Adminer process network telemetry with internal destination addresses that have no legitimate business justification.
Alert on file_get_contents() or outbound HTTP traffic originating from PHP-FPM workers hosting Adminer when destinations are internal.

Monitoring Recommendations

Monitor egress from web-tier hosts to internal subnets and flag anomalous service discovery patterns.
Enable PHP error logging and watch for repeated Elasticsearch driver connection failures from unauthenticated sessions.
Baseline normal Adminer traffic and alert on login endpoint request volume spikes consistent with scanning behavior.

How to Mitigate CVE-2026-100696

Immediate Actions Required

Upgrade Adminer to version 6.0.2 or later, which contains the fix for the Elasticsearch driver pre-auth SSRF.
If upgrade is not immediately possible, remove the Elasticsearch driver file (plugins/drivers/elastic.php) or stop deploying adminer/elastic.php.
Restrict network access to Adminer with authentication proxies, IP allowlists, or VPN-only exposure.

Patch Information

The vulnerability is fixed in Adminer 6.0.2. Full details are available in the GitHub Security Advisory GHSA-q8h3-4cx4-prgm and the VulnCheck advisory on Adminer SSRF.

Workarounds

Disable PHP's allow_url_fopen directive in php.ini for the Adminer host, which prevents file_get_contents() from making HTTP requests.
Avoid registering the Elasticsearch driver through adminer_object() configurations in custom builds.
Place Adminer behind an authenticating reverse proxy to block unauthenticated POST requests to the login endpoint.
Apply strict egress firewall rules to prevent the Adminer host from initiating connections to internal subnets.

bash

# Disable remote URL fetches in PHP to blunt SSRF via file_get_contents
# /etc/php/8.x/fpm/php.ini
allow_url_fopen = Off

# Reload PHP-FPM to apply
sudo systemctl reload php-fpm