CVE-2026-34964 Overview
CVE-2026-34964 is a server-side request forgery (SSRF) vulnerability in Adminer versions before 5.5.0. The flaw resides in the login form's server field validator, which inspects only leading integers when enforcing privileged-port restrictions and fails to reject non-numeric port values. Attackers can inject PDO Data Source Name (DSN) keys such as host= and port= into the server parameter. This lets them bypass the port allowlist and open TCP connections to arbitrary internal hosts and ports before authentication. The weakness is classified as CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can pivot Adminer instances into SSRF probes against internal infrastructure, enabling network reconnaissance and interaction with services that trust the Adminer host.
Affected Products
- Adminer database management tool
- Adminer versions prior to 5.5.0
- Deployments exposing the Adminer login form to untrusted networks
Discovery Timeline
- 2026-08-25 - CVE-2026-34964 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-34964
Vulnerability Analysis
Adminer accepts a server parameter on the login form to specify the database host. The validator intended to block connections to privileged ports parses only leading integers of the supplied value. Non-numeric characters after an integer are ignored, and non-numeric port values evade the check entirely. Because Adminer builds a PHP Data Objects (PDO) DSN from this input, attackers can append additional DSN key-value pairs. Injecting host= and port= overrides the intended destination, allowing the underlying PDO driver to open a TCP socket to any reachable host and port. The connection attempt occurs before authentication, so no valid credentials are required to trigger it.
Root Cause
The root cause is improper input validation in the server-field parser. The routine assumes port values are integers and applies a lexical shortcut that stops at the first non-digit character. It also fails to sanitize DSN metacharacters in the concatenated string, permitting DSN key injection into the PDO constructor.
Attack Vector
Exploitation is remote and unauthenticated over the network. An attacker submits a crafted server value to the Adminer login endpoint that embeds additional DSN keys. Adminer forwards the manipulated DSN to PDO, which resolves the injected host and establishes a TCP connection. The attacker observes response timing, error strings, and driver banners to enumerate internal services. See the GitHub Security Advisory GHSA-58cq-mgw2-38m5 and the VulnCheck SSRF Advisory for Adminer for technical details.
No verified proof-of-concept code is published in the referenced advisories. The vulnerability mechanism is described in prose above.
Detection Methods for CVE-2026-34964
Indicators of Compromise
- Login POST requests to Adminer where the server parameter contains substrings such as host=, port=, unix_socket=, or embedded semicolons.
- Outbound TCP connections initiated by the web server hosting Adminer to internal RFC1918 addresses or non-standard ports.
- PDO connection error messages in Adminer or PHP logs referencing hosts that do not match the intended database backend.
Detection Strategies
- Inspect web server access logs for anomalous server field content on Adminer authentication routes and alert on DSN keyword patterns.
- Correlate Adminer process network telemetry with expected database endpoints; any deviation warrants investigation.
- Deploy web application firewall rules that reject non-numeric characters and equals signs in the Adminer server parameter.
Monitoring Recommendations
- Monitor for repeated failed login attempts paired with varying server values, which suggest SSRF port scanning.
- Track egress connections from PHP-FPM or Apache worker processes to internal subnets and log destination host and port pairs.
- Alert on Adminer instances reachable from the public internet, since exposure materially increases exploitation risk.
How to Mitigate CVE-2026-34964
Immediate Actions Required
- Upgrade Adminer to version 5.5.0 or later on all instances.
- Restrict access to Adminer using network access control lists, VPN, or authenticated reverse proxy so the login form is not reachable from untrusted networks.
- Audit web and application logs for prior requests containing injected DSN keys in the server parameter.
Patch Information
Adminer 5.5.0 addresses the validator flaw by rejecting non-numeric port values and sanitizing DSN key characters in the server parameter. Deployment details are available in the GitHub Security Advisory GHSA-58cq-mgw2-38m5.
Workarounds
- Place Adminer behind an authenticating reverse proxy that requires SSO or client certificates before the login form is served.
- Enforce egress firewall rules on the Adminer host that only permit connections to sanctioned database servers and ports.
- Remove or disable Adminer in production environments where it is not actively required.
# Example egress restriction using iptables to allow only the intended DB host
iptables -A OUTPUT -o eth0 -p tcp -d 10.0.0.25 --dport 3306 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m owner --uid-owner www-data -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
