Executive brief
Adminer, a database administration tool, contains a vulnerability in its ClickHouse driver plugin that allows unauthenticated attackers to make the server send HTTP requests to arbitrary internal hosts and receive the full response. An attacker can exploit this to scan internal networks, identify services, and extract sensitive information like error messages, configuration details, and internal hostnames from internal applications. This vulnerability affects organizations that deploy Adminer 6.0.0 or 6.0.1 with the ClickHouse plugin enabled.
Technical details
Pre-authentication SSRF in plugins/drivers/clickhouse.php rootQuery() method introduced by the 6.0.0 rewrite: when the target server returns a non-2xx status (other than 401/403), the raw HTTP response body is stored as the connection error and reflected on the login page. An unauthenticated attacker submits auth[driver]=clickhouse&auth[server]=http://<internal-host>:<port> to trigger a POST /?database=default with body 'SELECT version()' to internal hosts, receiving full response bodies including stack traces and configuration identifiers. Network-level attack vector; no authentication or user interaction required; fixed in 6.0.2.
Affected products
- Adminer Adminer 6.0.0 through 6.0.1
Timeline
- 2026-09-26: disclosed: CVE-2026-100697 published
- 2026-09-26: patched: Fixed in Adminer 6.0.2