CVE-2026-100697: Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 6.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Adminer 6.0.0 and 6.0.1 are affected only when the official ClickHouse driver plugin at plugins/drivers/clickhouse.php is loaded. The vulnerable ClickHouse driver was rewritten in 6.0.0.
Does exploitation require an Adminer account or user interaction?
No. An unauthenticated attacker can trigger the behavior before authentication by submitting auth[driver]=clickhouse and setting auth[server] to an arbitrary URL.
What can an attacker retrieve through the SSRF behavior?
The Adminer server sends an HTTP POST containing SELECT version() to the supplied target. For target responses outside 200-299, except 401 and 403, the raw response body is displayed on the Adminer login page, allowing disclosure of internal-service error content such as stack traces, hostnames, file paths, and configuration identifiers.
What should be done if an immediate upgrade is not possible?
Remove or disable the official ClickHouse driver plugin so that the vulnerable driver cannot be selected. Upgrade to Adminer 6.0.2 when possible.