{
  "cveId": "CVE-2026-100698",
  "url": "https://patchblox.com/security/cve/CVE-2026-100698",
  "summary": "CVE-2026-100698 is fixed in adminer on 1 platform by DEBIAN-CVE-2026-100698 (version 6.0.2-1), released September 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "adminer: Adminer 5.5.1 through 6.0.1 improperly parses the login \u0027server\u0027 string in the host_port() function in adminer/includ...",
  "description": "Adminer 5.5.1 through 6.0.1 improperly parses the login \u0027server\u0027 string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.",
  "published": "2026-09-26T14:16:54Z",
  "severity": "",
  "epss": 0.00347,
  "epssPercentile": 0.28519,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "adminer",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2026-100698",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-100698",
      "released": "2026-09-27T20:04:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}