CVE-2026-100696

Name of the Vulnerable Software and Affected Versions Adminer versions 4.16.0 through 6.0.1

Description A pre-authentication Server-Side Request Forgery (SSRF) exists in the optional Elasticsearch driver located at plugins/drivers/elastic.php. The issue occurs because adminer/include/auth.inc.php calls the Driver::connect() function before validating the login result. An unauthenticated attacker can send crafted auth[server], auth[username], and auth[password] parameters to force the server to issue an HTTP GET request via get url() or file get contents() to an arbitrary reachable host and port. The driver fails to block loopback, private, or link-local addresses, and while it rejects ports below 1024, it appends the default port 9200 if none is provided. This allows for internal network reconnaissance and service fingerprinting, as connection failures and specific JSON error fields from non-2xx responses are displayed on the login page. This requires the Elasticsearch driver to be explicitly deployed and the PHP allow url fopen setting to be enabled.

Recommendations Update to version 6.0.2. Restrict the use of the plugins/drivers/elastic.php driver if it is not required. Disable the PHP allow url fopen setting to mitigate the risk.