{"id":"CVE-2026-119428","kind":"vulnerability","aliases":["CVE-2026-119428"],"related":[],"title":"phpMyAdmin: unauthenticated setup page lets attackers probe internal network ports","description":"phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.","summary":"phpMyAdmin through 5.2.3 has a setup validation page that does not check whether setup is disabled, so anyone can make the server open connections to hosts and ports they choose. An attacker can use the returned error messages to map which internal ports are open.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","phpmyadmin","runtime","self-hosted"],"not_affected_if":["network-restricted-access","setup-directory-removed"],"how_to_check":"- Check the phpMyAdmin version with `phpMyAdmin` version shown in the footer or `config.inc.php`; versions through `5.2.3` are in the affected range.\n- Check whether the `setup/` directory is reachable from the internet on the phpMyAdmin host.","fix":"- Move to a phpMyAdmin release later than `5.2.3`; the exact fixed version is not stated in the sources.","status":"open","published_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:42+00:00","updated_at":"2026-10-30T12:32:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:42Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a phpMyAdmin release later than `5.2.3`; the exact fixed version is not stated in the sources.","reach":"internet","title":"phpMyAdmin: unauthenticated setup page lets attackers probe internal network ports","impact":"low","summary":"phpMyAdmin through 5.2.3 has a setup validation page that does not check whether setup is disabled, so anyone can make the server open connections to hosts and ports they choose. An attacker can use the returned error messages to map which internal ports are open.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["phpmyadmin","mysql","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"server makes outbound connections; attacker maps internal ports","analyst_note":"Confirm the fixed phpMyAdmin version and whether setup/ is disabled by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119428.","how_to_check":"- Check the phpMyAdmin version with `phpMyAdmin` version shown in the footer or `config.inc.php`; versions through `5.2.3` are in the affected range.\n- Check whether the `setup/` directory is reachable from the internet on the phpMyAdmin host.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["setup-directory-removed","network-restricted-access"],"who_is_affected":"Any server running phpMyAdmin 5.2.3 or earlier where the setup directory is reachable from the network, since the flaw is in the unguarded setup/validate.php page. Installs that remove the setup directory or block it at the web server are likely not reachable through this path, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4165,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119428':13A,16A '-2026':12A,15A '5.2.3':25B,70C 'allow':80C 'anyon':40B 'attack':6A,54B,82C,96C,100C 'attacker-chosen':99C 'check':34B 'choos':52B 'chosen':101C 'connect':46B,86C,114C 'contain':71C 'cve':11A,14A 'disabl':38B,94C 'error':59B,121C 'forgeri':77C 'guard':95C 'host':22B,48B,102C 'intern':8A,64B,117C 'lack':90C 'let':5A 'make':42B 'map':62B 'messag':60B,122C 'mysql':17B,112C 'mysql-protocol':111C 'network':9A 'open':45B,67B,110C 'outbound':85C 'page':4A,30B 'phpmyadmin':1A,18B,23B,68C 'port':10A,50B,65B,104C,118C 'post':98C 'probe':7A,116C 'protocol':113C 'reach':106C 'request':76C 'return':58B,120C 'runtim':19B 'self':21B 'self-host':20B 'server':44B,74C 'server-sid':73C 'setup':3A,28B,36B,93C 'setup-dis':92C 'setup/validate.php':88C 'side':75C 'testdbconnect':108C 'trigger':84C 'unauthent':2A,81C 'use':56B,119C 'valid':29B,107C 'valu':105C 'via':87C 'vulner':78C 'whether':35B","nicknames":[],"mitigations":[],"who_affected":"Any server running phpMyAdmin 5.2.3 or earlier where the setup directory is reachable from the network, since the flaw is in the unguarded setup/validate.php page. Installs that remove the setup directory or block it at the web server are likely not reachable through this path, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119428","severity":null,"published_at":"2026-10-30T12:16:40+00:00","modified_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}