CVE-2026-119428
Received Received - Intake

phpMyAdmin Server-Side Request Forgery via setup/validate.php

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119428
EUVD
EUVD-2026-113808

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpMyAdmin phpMyAdmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyAdmin through version 5.2.3 has a server-side request forgery (SSRF) vulnerability in the setup/validate.php file. This flaw allows unauthenticated attackers to make outbound connections by sending crafted POST requests with attacker-controlled host and port values. The Validator::testDBConnection() function processes these values, enabling attackers to probe internal systems and open MySQL-protocol connections using error messages for feedback.

Detection Guidance

Detecting this vulnerability requires checking for outbound connections initiated by phpMyAdmin's setup/validate.php endpoint. Monitor network traffic for unexpected MySQL-protocol connections to internal hosts or ports. Check phpMyAdmin logs for POST requests to setup/validate.php with host and port parameters. Use tools like tcpdump or Wireshark to capture outbound connections from the phpMyAdmin server.

Impact Analysis

This vulnerability allows attackers to scan internal networks, probe open ports, and potentially access sensitive services. If exploited, it could lead to unauthorized data exposure, service disruption, or further attacks on internal systems. The impact depends on network configuration and exposed services.

Compliance Impact

This SSRF vulnerability could violate compliance requirements by enabling unauthorized network access or data exfiltration. GDPR may be impacted if personal data is exposed, while HIPAA could be violated if protected health information is compromised. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Immediately upgrade phpMyAdmin to version 5.2.4 or later to patch the vulnerability. If upgrading is not possible, disable the setup script by setting $cfg['CheckConfigurationPermissions'] = false in the configuration file. Restrict network access to phpMyAdmin using firewalls to prevent unauthorized outbound connections. Review and audit any existing phpMyAdmin installations for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart