Server-Side Request Forgery in Adminer by Emanating Technology

CVE-2026-100696

What is CVE-2026-100696?

The Adminer product versions 4.16.0 to 6.0.1 are susceptible to an SSRF vulnerability when utilizing the Elasticsearch driver plugin. This flaw allows an unauthenticated attacker to craft specific parameters that trigger HTTP GET requests to arbitrary endpoints within the network. The connection attempts are made via the adminer/include/auth.inc.php file, which executes Driver::connect() prior to confirming login credentials. Specifically, the validation process only checks for general server syntax and fails to block connections to reserved IP addresses. Consequently, attackers can perform port scanning and service fingerprinting, potentially exposing sensitive internal services. To mitigate this risk, users must apply the patch introduced in version 6.0.2 and ensure that the optional Elasticsearch driver is managed securely.

References