CVE-2026-100696
Received Received - Intake

Pre-authentication SSRF in Adminer via Elasticsearch Driver

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100696
EUVD
EUVD-2026-87669

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
adminer adminer From 4.16.0 (inc) to 6.0.1 (inc)
adminer adminer 6.0.2
vrana adminer From 4.16.0 (inc) to 6.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adminer versions 4.16.0 through 6.0.1 have a pre-authentication SSRF vulnerability in the optional Elasticsearch driver. An attacker can send crafted parameters to cause the server to make HTTP requests to arbitrary hosts and ports, enabling internal network scanning and service fingerprinting.

Detection Guidance

Check if the optional Elasticsearch driver (plugins/drivers/elastic.php) is deployed in your Adminer installation. Verify if PHP allow_url_fopen is enabled. Test by sending crafted auth parameters to the login page and observe if the server makes HTTP requests to arbitrary hosts or ports.

Impact Analysis

An attacker could exploit this to scan internal networks, identify services, and potentially access sensitive systems. The vulnerability requires the Elasticsearch driver to be deployed and PHP allow_url_fopen enabled.

Compliance Impact

This vulnerability could lead to unauthorized network access, data breaches, or information disclosure, potentially violating GDPR, HIPAA, or other regulations requiring network security and data protection.

Mitigation Strategies

Upgrade Adminer to version 6.0.2 or later. Remove the Elasticsearch driver if not needed. Disable PHP allow_url_fopen if possible. Implement network-level restrictions to block unauthorized outbound connections from the Adminer server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart