CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/vrana/adminer/security/advisories/GHSA-58cq-mgw2-38m5
https://www.vulncheck.com/advisories/adminer-before-ssrf-via-pdo-dsn-injection

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Adminer anterior a la versión 5.5.0 contiene una vulnerabilidad de falsificación de petición del lado del servidor en el validador del campo servidor del formulario de inicio de sesión, que solo inspecciona enteros iniciales para puertos privilegiados y no logra rechazar valores de puerto no numéricos. Los atacantes pueden inyectar claves PDO DSN como host= y port= en el parámetro servidor para eludir la restricción de puertos privilegiados y establecer conexiones TCP a hosts y puertos internos arbitrarios antes de la autenticación.

Information

Published : 2026-08-25 02:16

Updated : 2026-10-12 15:10

NVD link : CVE-2026-34964

Mitre link : CVE-2026-34964

CVE.ORG link : CVE-2026-34964

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-34964", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34964", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:58:27.282749Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "vrana", "product": "adminer", "versions": [{"status": "affected", "version": "0", "lessThan": "5.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-25T02:16:40.553", "references": [{"url": "https://github.com/vrana/adminer/security/advisories/GHSA-58cq-mgw2-38m5", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/adminer-before-ssrf-via-pdo-dsn-injection", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication."}, {"lang": "es", "value": "Adminer anterior a la versi\u00f3n 5.5.0 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor en el validador del campo servidor del formulario de inicio de sesi\u00f3n, que solo inspecciona enteros iniciales para puertos privilegiados y no logra rechazar valores de puerto no num\u00e9ricos. Los atacantes pueden inyectar claves PDO DSN como host= y port= en el par\u00e1metro servidor para eludir la restricci\u00f3n de puertos privilegiados y establecer conexiones TCP a hosts y puertos internos arbitrarios antes de la autenticaci\u00f3n."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}