CVE-2026-100697: Server-Side Request Forgery (SSRF) in vrana adminer
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.
AI Analysis
Technical Summary
Adminer 6.0.0 through 6.0.1, when using the official ClickHouse driver plugin, allows an unauthenticated attacker to submit crafted authentication parameters that trigger the server to issue HTTP POST requests to arbitrary URLs. If the target service responds with a status code outside 200-299 (excluding 401/403), the response body is displayed on the Adminer login page, enabling internal network reconnaissance and disclosure of sensitive internal information such as error pages, stack traces, hostnames, file paths, and configuration identifiers. This SSRF vulnerability is resolved in Adminer version 6.0.2.
Potential Impact
The vulnerability enables unauthenticated attackers to perform SSRF attacks against internal services, potentially revealing sensitive information from internal error responses. This can facilitate internal network and port reconnaissance and disclosure of confidential data contained in error messages. The CVSS 4.0 score is 5.3 (medium severity), reflecting the moderate risk of information disclosure without authentication.
Mitigation Recommendations
Upgrade Adminer to version 6.0.2 or later, where this SSRF vulnerability has been fixed. No additional mitigation is required once the official patch is applied.
CVE-2026-100697: Server-Side Request Forgery (SSRF) in vrana adminer
Description
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.
CVSS v4.0
Score 5.3medium
Affected software
vrana
adminer
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Adminer 6.0.0 through 6.0.1, when using the official ClickHouse driver plugin, allows an unauthenticated attacker to submit crafted authentication parameters that trigger the server to issue HTTP POST requests to arbitrary URLs. If the target service responds with a status code outside 200-299 (excluding 401/403), the response body is displayed on the Adminer login page, enabling internal network reconnaissance and disclosure of sensitive internal information such as error pages, stack traces, hostnames, file paths, and configuration identifiers. This SSRF vulnerability is resolved in Adminer version 6.0.2.
Potential Impact
The vulnerability enables unauthenticated attackers to perform SSRF attacks against internal services, potentially revealing sensitive information from internal error responses. This can facilitate internal network and port reconnaissance and disclosure of confidential data contained in error messages. The CVSS 4.0 score is 5.3 (medium severity), reflecting the moderate risk of information disclosure without authentication.
Mitigation Recommendations
Upgrade Adminer to version 6.0.2 or later, where this SSRF vulnerability has been fixed. No additional mitigation is required once the official patch is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:39:50.973Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9adf7a7c5410652fd61
Added to database: 09/26/2026, 13:33:33 UTC
Last enriched: 09/26/2026, 13:48:10 UTC
Last updated: 09/27/2026, 04:31:24 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.