CVE-2026-34964: Adminer before 5.5.0 SSRF via PDO DSN Injection
Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it because the vulnerable input is in the login form and no privileges or user interaction are required.
What network access does exploitation provide?
An attacker can cause the Adminer server to establish TCP connections to arbitrary internal hosts and ports by injecting PDO DSN host and port keys into the server parameter. This can expose services reachable from the Adminer host even when they are not directly reachable by the attacker.
Are default privileged-port protections sufficient?
No. The server-field validator attempts to restrict privileged ports, but non-numeric port values allow PDO DSN injection that bypasses this restriction.
How can exposure be reduced before updating?
Restrict access to the Adminer login form and limit the Adminer server's outbound network connectivity to only required database hosts and ports. This reduces an unauthenticated attacker's ability to use Adminer to reach internal services.