Advisory · CVE-2026-100697
Adminer pre-auth SSRF turns the login page into an internal network oracle
Adminer 6.0.0 through 6.0.1, with the official ClickHouse driver plugin loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL, making the Adminer server POST 'SELECT version()' to that host; when the target returns a non-2xx status, the raw response body lands on the login page. That enables internal network and port reconnaissance and leaks sensitive details from internal error pages. Fixed in 6.0.2.
- Vendor
- Adminer
- Product
- Adminer
- Identifier / CWE
- CVE-2026-100697
CWE-918 - Action timing
- Immediate
Explain it like I’m five
The login page lets a stranger pick which database to connect to, and then it helpfully shows the stranger the full reply it gets. A stranger can point it at the building's internal intercoms and read whatever they answer.
- 01Driver choice
The unauthenticated attacker submits auth[driver]=clickhouse with auth[server] pointing at an internal host.
- 02Server-side POST
Adminer issues an HTTP POST containing 'SELECT version()' to the attacker-chosen URL.
- 03Body reflected
On a non-2xx response, the raw response body is assigned to the connection error.
- 04Recon
The attacker reads the body on the login page, mapping internal services and harvesting error-page details.
What happened
Adminer 6.0.0 through 6.0.1, with the official ClickHouse driver plugin loaded, is vulnerable to pre-authentication server-side request forgery (CVE-2026-100697, CVSS 8.6). An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL, making the Adminer server POST “SELECT version()” to that host. When the target returns a non-2xx status, the raw response body is assigned to the connection error and rendered on the login page. That gives an unauthenticated attacker an internal network and port reconnaissance oracle, and leaks sensitive details exposed by internal error pages. The issue is fixed in Adminer 6.0.2.
What to do
- Upgrade Adminer to 6.0.2 or later.
- Do not expose Adminer to the public internet; restrict it to trusted networks or behind VPN and authentication.
- Review access logs for login attempts submitting the clickhouse driver with unusual auth[server] values.
- Audit what internal services the Adminer host could reach during the exposure window.
Management note
A database admin tool that answers to strangers is already a risk; one that forwards their questions to your internal network and reads the answers back is a reconnaissance gift. Patch it, and while you are at it, get Adminer off the public internet.