CVE-2026-100698

Executive Summary

CVE-2026-100698 is a server-side request forgery (SSRF) vulnerability in Adminer versions 5.5.1 through 6.0.1 that allows a remote, unauthenticated attacker to force the server to open TCP connections to arbitrary internal hosts and privileged ports before any credentials are validated. Adminer is a widely deployed single-file database management tool commonly exposed on internal networks and, in some cases, the public internet. The flaw is a regression that re-opens a previously patched bypass (GHSA-58cq-mgw2-38m5) and enables blind internal port scanning and SSRF against internal infrastructure, though it does not by itself permit code execution or data modification.

Technical Analysis

The vulnerability resides in the parsing of the login server string. Adminer's host_port() function in adminer/include/functions.inc.php uses a regular expression to split a host:port value into host and port. The port capture group requires pure digits anchored to the end of the string. When a server value contains a non-digit tail — for example 127.0.0.1:80/x — the regex fails to match the port, and the function falls back to returning the entire string as the host with an empty port.

The privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port value. Because the parse produced an empty port, the check is skipped entirely. Subsequently, the underlying mysqli/mysqlnd client re-parses host:port from the host string and establishes a TCP connection. This means the connection is initiated with the attacker-supplied host and privileged port, bypassing the intended restriction.

Critical characteristics:

• Pre-authentication reachability: The parsing occurs during login handling, so the attacker does not need valid credentials.
• Blind oracle: The server's response behavior (connection refused vs. handshake vs. timeout) reveals whether an internal host/port is reachable, enabling blind internal port scanning.
• Regression: The flaw re-introduces a bypass that was fixed in version 5.5.0 and tracked as GHSA-58cq-mgw2-38m5.
• Scope: CVSS scope is changed (S:C), reflecting that the vulnerable component impacts resources beyond its security authority — the internal network.

The described mechanism is a classic SSRF via inconsistent parsing between a security check and the downstream connection routine.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain below is inferred from the vulnerability class (CWE-918) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies an exposed Adminer login page, typically at a predictable path such as the tool's login form. Public scanning services and web crawlers frequently index Adminer instances by page title and HTML content.

2. Triggering the flaw: On the login page, the attacker supplies a crafted value in the server field (e.g., 127.0.0.1:80/x). The non-digit tail causes the regex in host_port() to fail, returning the whole string as the host with an empty port. The privileged-port check in auth.inc.php inspects only the empty parsed port and is bypassed.

3. Connection initiation: The mysqli/mysqlnd client re-parses the host string and opens a TCP connection to the attacker-controlled target host and port, all before credentials are validated.

4. Post-exploitation impact: By iterating over internal IP addresses and ports, the attacker performs blind internal port scanning using connection outcomes as a liveness oracle (connection refused vs. handshake vs. timeout). This mapping of internal services can support lateral movement and further attacks. No code execution, authentication bypass, or data read/write is provided by this flaw alone.

Because the attacker controls the server value, the SSRF target is arbitrary — any host reachable from the Adminer server, including loopback addresses and internal management interfaces, can be probed.

Impact Assessment

The CVSS v3.1 base score is 5.8 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. Key subscores:

• Attack Vector (Network): Exploitable remotely.
• Attack Complexity (Low): No special conditions; a single crafted request suffices.
• Privileges Required (None): The flaw is reachable pre-authentication.
• User Interaction (None): No victim action needed.
• Scope (Changed): The vulnerable component affects the internal network, expanding blast radius beyond Adminer itself.
• Confidentiality (Low): Limited to information leaked via the liveness oracle (internal topology).
• Integrity / Availability (None): No direct modification or denial of service.

Business impact: An attacker can enumerate internal services and network topology from an internet- or DMZ-exposed Adminer instance, potentially identifying database servers, admin panels, or other privileged services. This reconnaissance supports lateral movement. The flaw is especially dangerous in environments where Adminer is exposed publicly but can reach internal segments. Because it is pre-authentication, any internet-facing instance is at risk.

Affected systems: Any deployment running Adminer 5.5.1 through 6.0.1. Version 5.5.0 and earlier are not affected by this regression; version 6.0.2 resolves it.

Detection Guidance

Sigma Rule

title: Adminer SSRF via Crafted Server String (CVE-2026-100698)
id: 7b2f9e1a-3c4d-4e5f-9a6b-1d2e3f4a5b6c
status: experimental
description: Detects crafted Adminer login 'server' parameters containing a host:port followed by a non-digit tail, attempting to bypass the privileged-port restriction.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100698
  - https://github.com/vrana/adminer/security/advisories/GHSA-58cq-mgw2-38m5
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: 'adminer'
  selection_body:
    cs-uri-query|re: '(?i)server=\d{1,3}(\.\d{1,3}){3}:\d{1,5}[^0-9&]'
  condition: selection_method and selection_uri and selection_body
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate use of named hosts with trailing characters (unlikely)
level: medium
tags:
  - attack.t1190
  - cve.2026-100698

YARA Rule

rule CVE_2026_100698_Adminer_SSRF
{
    meta:
        description = "Detects crafted Adminer server strings attempting privileged-port bypass (CVE-2026-100698)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100698"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ssrf1 = /server=[0-9]{1,3}(\.[0-9]{1,3}){3}:[0-9]{1,5}[^0-9&]/
        $adminer = "adminer" nocase
        $func = "host_port"
        $file = "adminer/include/functions.inc.php"

    condition:
        $ssrf1 or ($adminer and $func) or $file
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100698 Adminer SSRF Crafted Server String Privileged Port Bypass"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"adminer"; nocase; http.request_body; pcre:"/server=[0-9]{1,3}(\.[0-9]{1,3}){3}:[0-9]{1,5}[^0-9&]/Ri"; classtype:attempted-recon; reference:cve,2026-100698; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100698; sid:2026100698; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "POST" and
    url.path : "*adminer*" and
    http.request.body.content : "server=*"]
  [network where event.action == "connection_attempted" and
    network.direction == "outbound" and
    destination.port <= 1024]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=*proxy*
| eval post_body = coalesce(form_data, cs_uri_query, http_request_body)
| where like(cs_method, "POST") AND (like(cs_uri_stem, "%adminer%") OR like(http_uri, "%adminer%"))
| regex post_body="server=\d{1,3}(\.\d{1,3}){3}:\d{1,5}[^0-9&]"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, cs_uri_stem, post_body
| sort - count
| table first_seen last_seen src_ip cs_uri_stem post_body count

Wazuh OSSEC Rule

<group name="web,adminer,ssrf,">
  <rule id="202610698" level="10">
    <if_sid>31100,31101</if_sid>
    <match>POST</match>
    <url>adminer</url>
    <regex>server=\d{1,3}(\.\d{1,3}){3}:\d{1,5}[^0-9&amp;]</regex>
    <description>CVE-2026-100698: Possible Adminer SSRF attempt via crafted server string targeting privileged port</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100698,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Adminer 6.0.2, but no vendor advisory or patch source is currently tracked.

1. Immediate mitigations

   • Restrict network access to Adminer instances. Do not expose the login page to untrusted networks; place it behind a VPN, bastion host, or IP allowlist.
   • Apply network egress controls / firewall rules so the web server hosting Adminer cannot initiate arbitrary outbound TCP connections to internal segments or privileged ports.
   • If Adminer must remain reachable, deploy at a reverse proxy that normalizes and validates the server/host parameter, rejecting values with non-numeric tails or unexpected characters.
   • Monitor for anomalous outbound connection attempts from the Adminer host, especially to loopback and privileged ports (<1024).

2. Patch / upgrade steps

   • Upgrade to Adminer 6.0.2 or later, which contains the fix.
   • Verify the deployed version against the affected range (5.5.1 through 6.0.1).
   • Because no vendor patch source is tracked, confirm the fix from the upstream Adminer release artifacts before relying on them.

3. Long-term hardening

   • Adopt a policy of never exposing database management tools directly to untrusted networks.
   • Implement outbound egress filtering and micro-segmentation so that any parser bypass cannot reach internal services.
   • Track reductions in CVSS scope-changed SSRF issues through regular dependency and version monitoring; note this is a regression of GHSA-58cq-mgw2-38m5, highlighting the value of regression testing security fixes.
   • Integrate the detection rules above into SOC monitoring to catch exploitation attempts.

References

• NVD — CVE-2026-100698: https://nvd.nist.gov/vuln/detail/CVE-2026-100698
• Adminer upstream project: https://www.adminer.org/
• Original fix advisory (regression source) GHSA-58cq-mgw2-38m5: https://github.com/vrana/adminer/security/advisories/GHSA-58cq-mgw2-38m5
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• CISA KEV Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE as of the report date. No public PoC, Nuclei template, or exploit code is available.