# CVE-2026-100698: Adminer server-side request forgery via host_port regex bypass

Source: https://junglewise.ai/threats/cve-2026-100698-adminer-5-5-1-through-6-0-1-improperly-parses-the-login-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100698 · Severity: medium · CVSS 5.8 · Published 2026-09-26

Adminer, a web-based database management tool, contains a flaw in how it parses server connection strings that allows unauthenticated attackers to bypass port restrictions. An attacker can craft a malicious server hostname to make Adminer initiate TCP connections to internal networks and privileged ports before any login credentials are validated. This enables attackers to perform internal network reconnaissance, probe for open services, and potentially access restricted systems on the network.

Technologies: [Vrana Adminer](https://junglewise.ai/threats/technologies/vrana-adminer). Vendors: [Vrana](https://junglewise.ai/threats/vendors/vrana).

## Quick answers

**Is CVE-2026-100698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100698 being exploited in the wild.

**How severe is CVE-2026-100698?** Medium severity, with a CVSS score of 5.8, published 26 September 2026.

**Which products and versions are affected?** Vrana Adminer 5.5.1 through 6.0.1.

**Is there a fix for CVE-2026-100698?** A patch was published on 2026-09-26: Fixed in version 6.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100698 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100698?** Check whether you run Vrana Adminer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The host_port() function in adminer/include/functions.inc.php uses a regex requiring pure digits for the port value and anchored to the end of the string. Any server string with a non-digit tail (e.g., "127.0.0.1:80/x") fails to match and returns the entire string as the host with an empty port. The privileged-port check in auth.inc.php only inspects the parsed port value, so it is bypassed when the port is empty. The mysqli/mysqlnd client then re-parses the host string and initiates a TCP connection to the intended host:port, including privileged ports. This is an unauthenticated network-based attack with no preconditions other than network access to the Adminer login page.

## Affected products

- Vrana Adminer 5.5.1 through 6.0.1

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 6.0.2

## References

- [https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj](https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj)
- [https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex](https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex)

## Related threats

- [Adminer remote code execution via UTF-8 BOM bypass in SQLite](https://junglewise.ai/threats/cve-2026-109347-adminer-before-6-1-1-contains-a-remote-code-execution)
- [Adminer cross-site scripting in CONNECTION_ID interpolation](https://junglewise.ai/threats/cve-2026-100695-adminer-before-6-0-2-contains-a-cross-site-scripting)