CVE-2026-100696: Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via geturl()/filegetcontents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminerobject() configuration; it is not loaded in a default build) and that PHP allowurlfopen be enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 6.0.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Only deployments where the optional Elasticsearch driver has been explicitly deployed are affected. Examples include use of the adminer/elastic.php template or an adminer_object() configuration that enables the driver.
Does exploitation require Adminer credentials or user interaction?
No. An unauthenticated attacker can submit crafted auth[server], auth[username], and auth[password] values because the driver connection is attempted before login validation.
What can an attacker reach through the vulnerable instance?
The Adminer server can be induced to issue an HTTP GET request to an arbitrary host and port reachable from that server. Loopback, private, link-local, and other reserved addresses are not blocked; ports below 1024 are rejected, and port 9200 is used when no port is supplied.
What should be done if an immediate upgrade is not possible?
Remove or disable the optional Elasticsearch driver so it is no longer deployed. The issue is fixed in version 6.0.2.
How can defenders identify possible exploitation?
Review access logs for unauthenticated login requests containing crafted auth[server], auth[username], or auth[password] parameters. Login-page errors may expose connection failures or selected JSON error fields, which attackers can use for internal port scanning and service fingerprinting.