CVE-2021-21311: Adminer server-side request forgery in bundled driver builds

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is unauthenticated and network reachable with a public exploit reference, and it is listed in CISA KEV with a near-term remediation due date, though CVSS impact is limited to low confidentiality and integrity.

What it is

Adminer versions 4.0.0 through 4.7.8 contain a server-side request forgery flaw, affecting builds that bundle all drivers such as adminer.php. An unauthenticated remote attacker can make the server issue requests to arbitrary destinations, which matters because Adminer is often exposed on internal networks and can be used to reach services that are not directly accessible.

Impact

An attacker gains the ability to send requests from the Adminer host to internal or external systems, enabling internal network reconnaissance and access to services reachable only from that host. The CVSS vector rates confidentiality and integrity impact as low with scope change, so direct data compromise is limited but pivot potential is real.

Attack surface

The flaw is network reachable with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is triggered through the Adminer web interface, specifically in builds that bundle all database drivers.

Exploitation

CVE-2021-21311 was added to CISA KEV on 2025-09-29 with a 2025-10-20 remediation due date, and EPSS gives a 30-day probability of about 0.90 (99.8th percentile). A public exploit document is referenced, and CISA lists no known ransomware campaign use.

What to do

• Upgrade Adminer to 4.7.9 or later, or apply the vendor patch commit, as the primary fix.
• If immediate upgrade is not possible, remove or restrict access to Adminer instances that bundle all drivers, and discontinue use where mitigations are unavailable per CISA guidance.
• Place Adminer behind authentication and network access controls so it is not reachable from untrusted networks.
• Segment the Adminer host so outbound requests to internal services are blocked or limited to required database endpoints.
• Track the CISA KEV due date of 2025-10-20 and confirm remediation for internet-facing and cloud deployments.

Detection

• Monitor Adminer host outbound connections for requests to internal RFC1918 addresses, loopback, or cloud metadata endpoints such as 169.254.169.254.
• Review web server and proxy logs for Adminer requests that correlate with unexpected outbound traffic from the same host.
• Alert on Adminer versions below 4.7.9 discovered by asset inventory or HTTP response fingerprinting.
• Correlate Adminer access logs with DNS or firewall logs showing resolution or connection attempts to unusual internal hostnames.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.