# CVE-2021-21311: SSRF in adminer

Source: https://junglewise.ai/threats/cve-2021-21311-adminer-ssrf-in-database-driver-bundling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-02-11. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2021-21311 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2021-02-11

Adminer, a popular open-source database management tool, contains a security flaw that allows attackers to make unauthorized network requests from the server. This could allow an attacker to scan internal networks, access sensitive internal services, or steal data that is not normally exposed to the internet. This vulnerability has been observed being used in active attacks, making immediate patching critical for organizations using this software.

Technologies: [Adminer](https://junglewise.ai/threats/technologies/adminer), [vrana/adminer (Packagist)](https://junglewise.ai/threats/technologies/packagist-vrana-adminer). Vendors: [Adminer](https://junglewise.ai/threats/vendors/adminer), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2021-21311 exploited in the wild?** Yes. CVE-2021-21311 is known to be exploited in the wild, first recorded on 29 September 2025. Treat it as urgent.

**How severe is CVE-2021-21311?** Critical severity, with a CVSS score of 3.1, published 11 February 2021.

**Which products and versions are affected?** Adminer 4.0.0 to 4.7.8; vrana/adminer (Packagist) ECOSYSTEM:introduced=0,fixed=4.7.9.

**Is there a fix for CVE-2021-21311?** Yes. vrana/adminer (Packagist): upgrade to 4.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-21311 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-21311?** Check whether you run Adminer or vrana/adminer (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vrana/adminer (Packagist): upgrade to 4.7.9 or later

  ```sh
  composer require vrana/adminer:^4.7.9
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Adminer versions 4.0.0 through 4.7.8, specifically affecting the 'adminer.php' distribution which bundles all database drivers. The flaw allows an unauthenticated remote attacker to force the server to initiate requests to arbitrary local or remote endpoints. This can be leveraged to bypass firewalls, perform internal port scanning, or access metadata services in cloud environments. The vulnerability is rooted in insufficient validation of user-supplied input used to establish database connections. A fix is available in version 4.7.9.

## Affected products

- Adminer Adminer 4.0.0 to 4.7.8

## Identifiers

- CVE-2021-21311
- GHSA-x5r2-hj5c-8jx6

## Timeline

- 2021-02-18: disclosed
- 2021-02-18: patched: Fixed in version 4.7.9
- 2025-09-29: kev added: Added to CISA KEV due to active exploitation

## Related threats

- [Adminer server-side request forgery in ClickHouse driver](https://junglewise.ai/threats/cve-2026-100697-adminer-6-0-0-through-6-0-1-when-the-official-clickhouse-driver)
- [Adminer cross-site scripting via MySQL version string](https://junglewise.ai/threats/cve-2026-56704-adminer-cross-site-scripting-via-mysql-version-string)
- [Adminer remote code execution via SQLite VACUUM INTO](https://junglewise.ai/threats/cve-2026-56703-adminer-remote-code-execution-via-sqlite-vacuum-into)
- [Adminer server field SSRF via PDO DSN injection](https://junglewise.ai/threats/cve-2026-34964-adminer-server-field-ssrf-via-pdo-dsn-injection)
- [Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution](https://junglewise.ai/threats/cve-2026-15686-adminer-multi-query-incorrect-check-of-function-return-value)