CVE-2026-100697

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.

• CWE-918

• https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v
• https://www.vulncheck.com/advisories/adminer-6.0.0-server-side-request-forgery-via-clickhouse-driver

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100691Hugo versions 0.75.0 through 0.165.x contain a stored cross-…5.4
• CVE-2026-100692Hugo is a static site generator. In versions after v0.123.0 …7.5
• CVE-2026-100693Hugo versions from v0.162.0 before v0.166.0 contain a case-s…8.4
• CVE-2026-100694Hugo is a static site generator. In versions from v0.56.0 th…6.1
• CVE-2026-100695Adminer before 6.0.2 contains a cross-site scripting vulnera…6.1
• CVE-2026-100696Adminer 4.16.0 through 6.0.1 contain a pre-authentication Se…5.8
• CVE-2026-100698Adminer 5.5.1 through 6.0.1 improperly parses the login 'ser…5.8
• CVE-2026-100699Nodemailer is a Node.js email-sending library. In versions >…5.3
• CVE-2026-1007Incorrect Authorization vulnerability in virtual gateway com…7.6
• CVE-2026-10070A vulnerability was found in macrozheng mall up to 1.0.3. Th…5.1
• CVE-2026-100700nodemailer before 10.0.6 contains a denial of service vulner…7.5
• CVE-2026-100701Nodemailer versions 5.0.0 through 10.0.1 use a process-globa…5.9