---
id: "CVE-2026-119428"
kind: "vulnerability"
aliases: ["CVE-2026-119428"]
title: "phpMyAdmin: unauthenticated setup page lets attackers probe internal network ports"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["mysql", "phpmyadmin", "runtime", "self-hosted"]
not_affected_if: ["network-restricted-access", "setup-directory-removed"]
published_at: "2026-10-30T12:16:40+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:32:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119428", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# phpMyAdmin: unauthenticated setup page lets attackers probe internal network ports

phpMyAdmin through 5.2.3 has a setup validation page that does not check whether setup is disabled, so anyone can make the server open connections to hosts and ports they choose. An attacker can use the returned error messages to map which internal ports are open.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the phpMyAdmin version with `phpMyAdmin` version shown in the footer or `config.inc.php`; versions through `5.2.3` are in the affected range.
- Check whether the `setup/` directory is reachable from the internet on the phpMyAdmin host.

## Fix

- Move to a phpMyAdmin release later than `5.2.3`; the exact fixed version is not stated in the sources.

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119428

## From the sources

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_