Server-Side Request Forgery (SSRF) affecting Adminer
A high classified vulnerability affecting Adminer would allow an unauthenticated attacker to perform server-side request forgery (SSRF) and disclose sensitive information about affected systems.
Description
Technical context and vulnerability details
Adminer is a web database management tool that allows you to manage multiple types of databases through a single user interface. This product is affected by a vulnerability labeled CVE-2026-100697 which results from insufficient validation of requests submitted via the official ClickHouse driver. Exploitation of this vulnerability would allow an unauthenticated attacker to submit a spoofed request to the Adminer server, causing it to query arbitrary internal hosts. If the internal target returns an HTTP response with a status of 401 or 403, then the body of this response would be displayed on the login page, resulting in the disclosure of sensitive information. It is classified high with a severity score of 8.6 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Data privacy breach;
- Recognition of the internal network;
Affected systems
Products, components and targeted versions
- All versions of Adminer for which the official ClickHouse driver (plugins/drivers/clickhouse.php) is loaded;
- Adminer versions 6.0.0 and 6.0.1;
RECOMMENDED ACTIONS:
- Disable the official ClickHouse driver if not in use;
- Update Adminer to version 6.0.2 or the latest stable version available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.