CVE-2026-100697
Received Received - Intake

Server-Side Request Forgery in Adminer ClickHouse Driver

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100697
EUVD
EUVD-2026-87670

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
adminer adminer From 6.0.0 (inc) to 6.0.1 (inc)
adminer adminer 6.0.2
vrana adminer From 6.0.0 (inc) to 6.0.1 (inc)
vrana adminer 6.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication server-side request forgery (SSRF) vulnerability in Adminer versions 6.0.0 through 6.0.1 when using the official ClickHouse driver plugin. An unauthenticated attacker can send a crafted request with the driver set to 'clickhouse' and the server parameter pointing to an arbitrary URL. This forces Adminer to send an HTTP POST request with a 'SELECT version()' query to the specified host. If the target responds with a non-2xx status code (excluding 401/403), the raw HTTP response body is displayed on the Adminer login page, exposing sensitive internal information.

Detection Guidance

Check if Adminer 6.0.0 through 6.0.1 is installed and if the ClickHouse driver plugin is enabled. Monitor network traffic for unexpected HTTP POST requests to internal services containing 'SELECT version()' from Adminer. Inspect Adminer login pages for raw HTTP response bodies from internal hosts.

Impact Analysis

An attacker could exploit this to perform internal network reconnaissance, scan internal ports, and access sensitive data from internal services. This includes viewing error messages, stack traces, internal hostnames, file paths, configuration details, or even credentials if exposed in error pages. The impact includes potential data breaches, unauthorized access to internal systems, and compromise of confidential information.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive personal or health data, violating GDPR and HIPAA requirements. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A breach exposing such data could result in legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Adminer to version 6.0.2 or later to patch the vulnerability. Disable the ClickHouse driver plugin if not required. Restrict Adminer to trusted networks and implement network-level controls to block unauthorized internal requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart