CVE-2026-100698: Adminer SSRF Vulnerability

CVE-2026-100698 Overview

CVE-2026-100698 is a Server-Side Request Forgery (SSRF) vulnerability in Adminer, the popular PHP-based database management tool. The flaw affects versions 5.5.1 through 6.0.1 and resides in the host_port() function in adminer/include/functions.inc.php. A regression re-opens a bypass previously fixed in version 5.5.0 under GHSA-58cq-mgw2-38m5. Unauthenticated attackers who can reach the Adminer login page can submit crafted server values to force the backend to initiate TCP connections to arbitrary internal hosts and privileged ports. The issue is tracked under [CWE-918] and is fixed in Adminer 6.0.2.

Critical Impact
Unauthenticated remote attackers can abuse the Adminer login endpoint to perform internal port scanning and SSRF against hosts reachable from the Adminer server.

Affected Products

Adminer 5.5.1 through 6.0.1
Deployments relying on the privileged-port restriction in adminer/include/auth.inc.php
Adminer instances exposed to untrusted networks via the login page

Discovery Timeline

2026-09-26 - CVE-2026-100698 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100698

Vulnerability Analysis

The vulnerability stems from flawed parsing of the login server string. The host_port() function uses a regular expression whose port capture group requires pure digits anchored to the end of the string. Any value with a non-digit tail fails the regex match. On failure, the function returns the entire input as the host component and an empty string as the port.

The privileged-port restriction in auth.inc.php inspects only the parsed port value. Because the port is empty, the check is skipped entirely. The mysqli/mysqlnd client then re-parses host:port directly from the host string and opens a TCP connection to the attacker-chosen target before credentials are validated.

This bypass allows blind internal port scanning. Distinct responses such as connection refused, protocol handshake, and timeout act as a liveness oracle for arbitrary internal services.

Root Cause

The root cause is a parser-differential between Adminer's regex-based host_port() splitter and the native MySQL client's host parser. The authorization layer trusts Adminer's parse result, while the connection layer trusts its own. Attackers inject tails such as /x to force the regex to fail while the client still extracts a usable host and port.

Attack Vector

A remote, unauthenticated attacker submits a crafted server parameter such as 127.0.0.1:80/x to the Adminer login page. The regex fails, the privileged-port check is bypassed, and the backend initiates an outbound TCP connection to the specified internal host and port. See the VulnCheck advisory on SSRF in Adminer for additional technical detail.

// Illustrative payload submitted to the login form
server = 127.0.0.1:80/x
// host_port() returns host="127.0.0.1:80/x", port=""
// Privileged-port check sees empty port and is skipped
// mysqli client re-parses and connects to 127.0.0.1:80

Detection Methods for CVE-2026-100698

Indicators of Compromise

Repeated failed Adminer login attempts with unusual server values containing colons, slashes, or non-digit tails such as host:port/x.
Outbound TCP connections from the Adminer host to internal RFC1918 addresses or privileged ports (<1024) not previously observed in baselines.
Web access logs showing POSTs to the Adminer login endpoint with high entropy in the server field from a single source IP.

Detection Strategies

Alert on web requests to Adminer where the submitted server parameter contains characters outside the host:port pattern.
Correlate Adminer process network telemetry with login POSTs to identify SSRF-induced connections prior to authentication.
Baseline normal database targets for the Adminer host and flag deviations to loopback, link-local, or metadata service ranges.

Monitoring Recommendations

Enable verbose access logging on the web server fronting Adminer and ship logs to a central analytics platform.
Monitor egress firewall logs for short-lived TCP connect attempts originating from the Adminer host to internal segments.
Track Adminer version strings across the environment to identify instances still running 5.5.1 through 6.0.1.

How to Mitigate CVE-2026-100698

Immediate Actions Required

Upgrade Adminer to version 6.0.2 or later, which corrects the host_port() parsing logic.
Restrict network access to the Adminer login page using IP allowlists, VPN, or reverse-proxy authentication.
Apply egress filtering on the Adminer host to deny outbound connections to internal networks and cloud metadata endpoints.

Patch Information

The maintainers released a fix in Adminer 6.0.2. Review the GitHub Security Advisory GHSA-rwxg-xph9-82cj for upgrade guidance and the full set of affected versions.

Workarounds

Place Adminer behind an authenticating reverse proxy to block unauthenticated access to the login endpoint.
Deploy a web application firewall rule that rejects server parameter values not matching a strict host[:port] pattern.
Run Adminer in a network segment with no route to sensitive internal services or privileged ports.

bash

# Example nginx WAF-style constraint rejecting malformed server values
location /adminer/ {
    if ($arg_server ~* "[^A-Za-z0-9\.\-:]") {
        return 400;
    }
    proxy_pass http://adminer_backend;
}