Server-side Request Forgery in Adminer 5.5.1 to 6.0.1 Affects Remote Database Access

CVE-2026-100698

What is CVE-2026-100698?

Adminer versions 5.5.1 through 6.0.1 contain a vulnerability that allows remote, unauthenticated attackers to execute server-side request forgery (SSRF) attacks by exploiting improper parsing of the login 'server' string. This flaw enables attackers to initiate TCP connections to arbitrary internal hosts and privileged ports even before authentication takes place, effectively compromising internal network resources. The issue can lead to potential information leakage, as attackers can discern the status of internal services based on the response timing metrics. This vulnerability is a regression of a previously patched issue and has been resolved in Adminer version 6.0.2.

References