CVE-2026-100697: Adminer ClickHouse SSRF Vulnerability

CVE-2026-100697 Overview

CVE-2026-100697 is a pre-authentication server-side request forgery (SSRF) vulnerability in Adminer 6.0.0 through 6.0.1. The flaw exists when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php), rewritten in version 6.0.0, is loaded. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL. The Adminer server then issues an HTTP POST containing SELECT version() to the attacker-specified host. Response bodies from the internal target are rendered on the login page, exposing internal service content. The issue is tracked under [CWE-918] and is fixed in Adminer 6.0.2.

Critical Impact
Unauthenticated attackers can probe internal network services and exfiltrate response bodies containing stack traces, hostnames, file paths, and configuration data from systems reachable by the Adminer host.

Affected Products

Adminer 6.0.0 (with ClickHouse driver plugin loaded)
Adminer 6.0.1 (with ClickHouse driver plugin loaded)
Fixed in Adminer 6.0.2

Discovery Timeline

2026-09-26 - CVE-2026-100697 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100697

Vulnerability Analysis

Adminer is a PHP-based database management tool. Version 6.0.0 rewrote the official ClickHouse driver plugin at plugins/drivers/clickhouse.php. The rewritten driver accepts the auth[server] parameter as a destination URL for the ClickHouse HTTP interface without validating that the host is a legitimate ClickHouse endpoint. When an unauthenticated request specifies auth[driver]=clickhouse, the server initiates an outbound HTTP POST containing the query SELECT version() to the attacker-chosen URL.

The response handling path amplifies the impact. In rootQuery(), if the target returns an HTTP status outside the 200-299 range (excluding 401 and 403), the raw HTTP response body is assigned to the connection error object. Adminer then renders that error on the login page. The attacker receives the full body of the internal service response, converting a blind SSRF into a full-read SSRF.

Root Cause

The root cause is missing validation of the auth[server] parameter in the ClickHouse driver combined with unsafe error rendering. The driver treats the server field as a free-form URL and relays backend response bodies into the user-visible error channel without sanitization or scoping.

Attack Vector

Exploitation requires a single unauthenticated HTTP POST to the Adminer login endpoint. The attacker sets auth[driver]=clickhouse and auth[server] to an internal URL such as http://127.0.0.1:18089 or any host-reachable network address. The attacker then reads the returned error page to recover the proxied response. This enables port scanning across the Adminer host's internal network, service fingerprinting, and extraction of sensitive content from internal error pages, metadata endpoints, and management consoles.

See the GitHub Security Advisory and the VulnCheck Advisory on Adminer for additional technical detail.

Detection Methods for CVE-2026-100697

Indicators of Compromise

POST requests to Adminer login endpoints containing the parameter pair auth[driver]=clickhouse and auth[server] set to internal, loopback, or metadata IP addresses.
Outbound HTTP POST traffic from the Adminer server carrying the payload SELECT version() to non-ClickHouse hosts or unusual internal ports.
Adminer login responses that embed content resembling internal stack traces, cloud metadata, or non-ClickHouse error pages.

Detection Strategies

Inspect web server access logs for Adminer login submissions that include auth[driver]=clickhouse with server values targeting RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
Monitor egress from the Adminer host for HTTP POST traffic to ports not associated with ClickHouse (default 8123) or to internal management interfaces.
Correlate repeated failed Adminer logins paired with varying auth[server] values, which indicates automated internal port scanning.

Monitoring Recommendations

Centralize Adminer web and application logs into a SIEM and alert on first-seen combinations of the ClickHouse driver with non-ClickHouse destination hosts.
Baseline normal outbound destinations from the Adminer host and alert on new internal targets.
Track response sizes on the Adminer login endpoint; unusually large error responses may indicate proxied internal content.

How to Mitigate CVE-2026-100697

Immediate Actions Required

Upgrade Adminer to version 6.0.2 or later on all hosts where the ClickHouse driver plugin is loaded.
If an upgrade is not immediately possible, unload or remove plugins/drivers/clickhouse.php from the Adminer installation.
Restrict access to the Adminer interface using network ACLs, VPN gating, or authenticated reverse proxies.
Review Adminer and web server logs for prior exploitation attempts referencing auth[driver]=clickhouse.

Patch Information

The vulnerability is fixed in Adminer 6.0.2. The upstream fix is documented in the GitHub Security Advisory GHSA-77qq-q8fv-x45v. Administrators should deploy the patched release and verify the ClickHouse driver file matches the 6.0.2 version.

Workarounds

Remove the ClickHouse driver plugin file if ClickHouse connectivity is not required.
Place Adminer behind an egress firewall that blocks outbound traffic to loopback, link-local, and internal management ranges.
Enforce authentication at the web server tier (for example, HTTP basic auth or mTLS) in front of Adminer to prevent unauthenticated access to the login endpoint.

bash

# Example egress restriction using iptables on the Adminer host
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT