CVE-2026-100698 Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

What is CVE-2026-100698?

CVE-2026-100698 is a medium-severity server-side request forgery vulnerability in vrana adminer, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.

Weakness: CWE-918

Which versions are affected by CVE-2026-100698?

How do I fix CVE-2026-100698?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-100698 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100698 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-100698, GHSA-rwxg-xph9-82cj, GHSA-wrf7-8p9h-xp6p, UBUNTU-CVE-2026-100698.