CVE-2026-16434

Executive Summary

CVE-2026-16434 describes an incomplete fix for a prior X-Forwarded-Prefix header validation vulnerability in Adminer versions 4.6.0 through 5.5.0. The vulnerability allows an attacker who can control the X-Forwarded-Prefix HTTP header to inject a network-path reference containing a backslash character that bypasses the existing validation regex, leading to anomalous cookie-path scoping in the Set-Cookie response header. The issue is fixed in Adminer 5.5.1 and requires a specific network misconfiguration (an absent or improperly configured reverse proxy that permits client-supplied X-Forwarded-Prefix headers) to be exploitable.

Technical Analysis

The vulnerability resides in the validation logic implemented in the bootstrap.inc.php file, which was introduced as a patch for a prior advisory (GHSA-8478-xrj3-h9c2). That original advisory addressed an X-Forwarded-Prefix injection that allowed attackers to influence the cookie path attribute in Adminer's session handling.

The validation guard was designed to reject prefix values matching the regular expression ^/[^/], which blocks prefixes beginning with a forward slash followed by a non-slash character. This pattern successfully prevents values such as //evil.com from passing validation. However, the regex fails to account for backslash characters. A value such as /\evil.com passes validation because the second character — a backslash (\) — does not match the [^/] character class in a way that triggers rejection, and the overall pattern match does not occur as intended.

The attack mechanism leverages browser URL normalization behavior. Web browsers normalize backslash characters to forward slashes in URL contexts. Consequently, when a client submits X-Forwarded-Prefix: /\evil.com, a reverse proxy that faithfully passes this header to the backend will cause Adminer to use the value in constructing REQUEST_URI. The backslash is normalized to a forward slash by the browser during subsequent requests, turning the value into //evil.com — a network-path reference (protocol-relative URL). This normalized value is then supplied to the internal cookie_path() function, which uses it to set the Path attribute of the Set-Cookie response header.

The impact is constrained to anomalous cookie-path scoping. If an attacker can influence the cookie path to point to an attacker-controlled domain or path, cookies may be transmitted to unexpected destinations, potentially enabling session fixation, cookie leakage, or cross-site session manipulation — though the practical exploitation window depends heavily on the deployment environment.

Attack surface requires three preconditions: (1) the target runs an affected Adminer version (4.6.0 through 5.5.0); (2) the deployment does not strip or overwrite the X-Forwarded-Prefix header at the reverse proxy layer; and (3) the Attacker can reach the Adminer interface either directly or through the misconfigured proxy. The CVSS vector reflects the high attack complexity and the requirement for a non-standard network configuration.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker identifies an Internet-facing Adminer installation. Adminer is commonly deployed as a lightweight database management interface (single PHP file, often accessible under predictable paths such as /adminer.php or /adminer/). The attacker fingerprints the version by requesting the login page and inspecting version indicators in the HTML source or response headers. Shodan queries targeting the Adminer banner or page title can identify exposed instances.

Step 2: Triggering the Flaw

The attacker crafts an HTTP request to the Adminer interface that includes a custom X-Forwarded-Prefix header with a backslash-containing value, for example: X-Forwarded-Prefix: /\attacker.example. This value bypasses the validation regex ^/[^/] because the backslash does not match the rejection pattern. The request is forwarded through the reverse proxy to the Adminer backend. If the proxy does not overwrite or sanitize this header, Adminer's bootstrap logic incorporates the value into the request URI construction.

Step 3: Payload Execution and Impact

Upon processing the request, Adminer invokes the internally referenced cookie_path() function with the manipulated prefix. Because the browser normalizes the backslash to a forward slash, the resulting cookie path becomes a network-path reference (//attacker.example). The Set-Cookie response header now carries a Path attribute pointing to an external origin. The attacker can subsequently observe whether the victim's browser transmits the Adminer session cookie to the attacker-controlled domain, or the attacker can leverage the cross-origin cookie placement to conduct session-related attacks.

Step 4: Post-Exploitation

The practical post-exploitation impact depends on the attacker's ability to capture or manipulate the scoped cookie. If the victim's browser sends cookies with a path pointing to the attacker's domain, session tokens may leak. Alternatively, the attacker could abuse cookie-path scoping to perform session fixation by placing a known session identifier. No public PoC is available, and the practical exploitation chain is inferred from the vulnerability class. The overall impact is limited to anomalous cookie-path scoping, with no evidence of remote code execution, data exfiltration, or authentication bypass.

Impact Assessment

The vulnerability carries a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (score N/A). The attack vector is network-based, but the attack complexity is high due to the requirement for a misconfigured reverse proxy that passes client-supplied X-Forwarded-Prefix headers. No privileges are required, and no user interaction is needed. The security impact is confined to a limited integrity violation (anomalous cookie-path scoping); there is no confidentiality or availability impact.

Business impact: Organizations running Adminer behind a properly configured reverse proxy that either strips or overrides X-Forwarded-Prefix are not exposed. However, deployments that rely on the header for correct host/prefix resolution and do not guard against client-supplied values are at risk of session cookie misdirection, which could lead to session hijacking or fixation in complex environments. The affected asset is the Adminer management interface; the blast radius is limited to the cookie handling of that session, not the underlying database.

Detection Guidance

Sigma Rule

title: Adminer X-Forwarded-Prefix Backslash Injection Attempt
id: 8f7a4c2e-5d6b-4a9e-9f2a-1c3d4e5f6a7b
status: experimental
description: Detects HTTP requests to Adminer endpoints with an X-Forwarded-Prefix header containing a backslash character, indicating an attempt to exploit CVE-2026-16434.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16434
author: Valtersit Threat Intelligence
date: 2026/04/15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.url|contains:
            - 'adminer.php'
            - 'adminer/'
        http.request.headers|contains: 'X-Forwarded-Prefix:'
    filter_known_good:
        http.request.headers|re: 'X-Forwarded-Prefix:\s*/[a-zA-Z0-9_\-/]+$'
    condition: selection and not filter_known_good
    # Note: filter_known_good intentionally rejects only clean single-slash prefixes.
level: high
falsepositives:
    - Legitimate reverse proxy configuration using backslash in prefix (rare)
    - Proxies that append client-supplied header values without sanitization
tags:
    - attack.t1190
    - cve.2026.16434

YARA Rule

rule Adminer_XForwardedPrefix_Backslash
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PHP source files containing vulnerable X-Forwarded-Prefix validation logic in Adminer 4.6.0 through 5.5.0"
        reference = "CVE-2026-16434"
        date = "2026-04-15"
        score = 60
    strings:
        $a = "X-Forwarded-Prefix" nocase
        $b = "^/[^/]" ascii
        $c = "cookie_path" ascii
        $d = "bootstrap.inc.php" ascii
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Adminer X-Forwarded-Prefix Backslash Injection Attempt (CVE-2026-16434)";
    flow:to_server,established;
    http.header_names;
    content:"X-Forwarded-Prefix";
    http.header_names;
    pcre:"/X-Forwarded-Prefix\s*:\s*\/\\\\/i";
    http.uri;
    pcre:"/adminer\.php|adminer\//i";
    reference:cve,2026-16434;
    classtype:attempted-recon;
    sid:202616434;
    rev:1;
    metadata:created_at 2026_04_15, updated_at 2026_04_15;
)

Elastic Detection

sequence by source.ip
  [http where http.request.headers contains "X-Forwarded-Prefix" and startsWith(http.request.uri, "adminer") and http.request.headers matches "/.*/\\\\.*/"]
  [http where http.response.headers contains "Set-Cookie" and http.response.headers matches "/.*Path=\/\/.*/"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval has_xfp = if(match(headers, "X-Forwarded-Prefix"), 1, 0)
| eval has_backslash = if(match(headers, "X-Forwarded-Prefix\s*:\s*/\\\\"), 1, 0)
| eval adminer_uri = if(match(uri_path, "adminer"), 1, 0)
| where has_xfp=1 AND has_backslash=1 AND adminer_uri=1
| table _time, src_ip, uri_path, headers, response_headers
| sort - _time
| stats count by src_ip, uri_path

Wazuh OSSEC Rule

<group name="web_attacks,">
  <rule id="707994" level="12">
    <decoded as="json">no</decoded>
    <match>X-Forwarded-Prefix</match>
    <regex>X-Forwarded-Prefix:\s*/\\</regex>
    <description>Adminer CVE-2026-16434 - X-Forwarded-Prefix header with backslash injection attempt</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Note: While the NVD description states the issue is "fixed in 5.5.1," no vendor advisory, changelog, commit, or CVE-related patch source has been identified within our tracked intelligence sources. The patch confidence reflects this lack of verified patch evidence. Security teams should treat the current status as unpatched until a verified vendor release note is published.

Immediate Mitigations

1. Reverse proxy hardening (highest priority): Configure any reverse proxy or load balancer in front of Adminer to strip, overwrite, or reject client-supplied X-Forwarded-* headers. This is the primary control against this vulnerability.
2. Network-level filtering: Deploy a WAF rule to reject HTTP requests containing an X-Forwarded-Prefix header with a backslash character.
3. Access restriction: Limit access to the Adminer interface to internal networks or VPN users only.

Patch/Upgrade Steps

1. Monitor vendor channels for the official 5.5.1 release and apply the upgrade as soon as it becomes available.
2. If the fix is not yet available in a distribution channel (e.g., package manager), assess compatibility with the upstream source and consider a manual hotfix to the bootstrap.inc.php validation regex — specifically, extend the regex to reject backslash characters (e.g., ^/[^/\\\\]), but only after code review.

Long-Term Hardening

1. Remove or disable Adminer in production environments unless absolutely required; use it only in isolated development/staging networks.
2. Enforce a policy that all X-Forwarded-* headers are overwritten, not appended or passed through, at any reverse proxy layer.
3. Maintain an inventory of exposed Adminer instances and incorporate CVE monitoring for the product into routine vulnerability management.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16434
2. GitHub Security Advisory (GHSA-8478-xrj3-h9c2) — prior advisory for the incomplete fix: https://github.com/advisories/GHSA-8478-xrj3-h9c2 (returned 404 — verify manually)
3. Adminer official website: https://www.adminer.org/
4. CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild evidence, or active exploitation of CVE-2026-16434 has been observed as of the report date. No exploit code or Nuclei template exists. The vulnerability is currently not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.