CVE-2026-100696 Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
Unauthenticated attackers can perform Server-Side Request Forgery to scan internal networks and fingerprint services if the optional Elasticsearch driver is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100696?
CVE-2026-100696 is a medium-severity server-side request forgery vulnerability in vrana adminer, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.
Weakness: CWE-918
Which versions are affected by CVE-2026-100696?
How do I fix CVE-2026-100696?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-100696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100696 exists.
Sources
Also known as DEBIAN-CVE-2026-100696, GHSA-c9jj-9w3r-2hj8, GHSA-q8h3-4cx4-prgm, UBUNTU-CVE-2026-100696.