Do Son 
TL;DR
Security researchers disclosed seven phpMyAdmin vulnerabilities on October 30, 2026. These flaws allow web forgery, authentication bypass, and internal network scans. They also allow SQL injection in database tools. Therefore, system administrators must act now.
- Total: 7 CVEs
- Severity: 2 High · 5 Medium
- Actively exploited: None confirmed
- Highest severity: 7.7 (High · CVSSv4) — CVE-2026-119426
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Status |
|---|---|---|---|
| CVE-2026-119426 | 7.7 | through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql | Not exploited |
| CVE-2026-119561 | 7.6 | through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer | Not exploited |
| CVE-2026-119428 | 6.3 | through 5.2.3 SSRF via setup/validate.php After Setup Disabled | Not exploited |
| CVE-2026-119429 | 5.3 | through 5.2.3 Two-Factor Authentication Removal via /config/set | Not exploited |
| CVE-2026-119563 | 5.1 | through 5.2.3 Stored XSS via Designer Query History Table Name | Not exploited |
| CVE-2026-119427 | 2.3 | through 5.2.3 SQL Injection via Designer saveSetting | Not exploited |
| CVE-2026-119562 | 2.3 | through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute | Not exploited |
Why It Matters
phpMyAdmin is a top web tool for managing MySQL and MariaDB databases. Web hosts deploy phpMyAdmin on millions of servers worldwide. Many web apps rely on it to handle data. Consequently, flaws in this database tool put company databases at risk. If an attacker breaches the tool, they can read or change private data.
Fortunately, researchers confirm that no active exploitation in the wild has occurred. Furthermore, security teams have found no public exploit code for these bugs.
How the Attack Works
The security advisories detail multiple attack paths across these phpMyAdmin vulnerabilities.
CSRF and WebAuthn Authentication Bypasses
First, CVE-2026-119426 allows cross-site request forgery. The advisory states that “phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability.” Attackers can lure logged-in users to submit forged web requests. Then, the server runs arbitrary SQL commands with the victim’s rights.
Second, CVE-2026-119561 enables two-factor login bypass. The report notes that the tool “never verifies WebAuthn assertion signatures against stored public keys.” A user who knows a database password can forge a response. This trick bypasses the second login factor. Meanwhile, CVE-2026-119429 lets a bad actor drop two-factor settings from a stolen session without re-authentication.
SSRF and SQL Injection Risks
Third, CVE-2026-119428 brings a server-side request forgery flaw in setup/validate.php. The advisory warns that the script “lacks the setup-disabled guard.” Attackers can submit arbitrary host and port values. In turn, they can probe internal network ports. They can also view error text.
Finally, three flaws create SQL injection and stored script injection risks. The advisory explains: “Attackers can create a table whose name contains HTML markup that executes in another user’s session.” This issue, CVE-2026-119563, triggers in designer query mode. In addition, CVE-2026-119427 and CVE-2026-119562 permit SQL injection via designer settings and central columns. Attackers can tamper with configuration tables run with controluser rights.
Affected Versions
These phpMyAdmin vulnerabilities affect all versions through phpMyAdmin 5.2.3.
Patch and Mitigation Steps
Database administrators should check the latest patches on the official phpMyAdmin releases page. Users should update to the newest software build as soon as available. Furthermore, administrators should place phpMyAdmin behind private networks or secure VPN tunnels. Teams should also block public web access to setup scripts.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
