Skip to content
OpenAdvisories
High WID-SEC-2026-2613 7 CVEs

pgAdmin: Mehrere Schwachstellen

Published Aug 2, 2026 · Updated Nov 1, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Product

pgAdmin ist eine Verwaltungs- und Entwicklungsplattform für die PostgreSQL-Datenbank.

Vulnerabilities 7

  • Critical 9.9
    CVE-2026-17566 Public exploit

    pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

    pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create…

    pgadmin.org pgAdmin 4
  • Critical 9.6
    CVE-2026-17349

    pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

    /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared…

    pgadmin.org pgAdmin 4
  • Critical 9.0
    CVE-2026-17351

    pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

    The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wr…

    pgadmin.org pgAdmin 4
  • High 8.8
    CVE-2026-17346

    pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

    The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test_sql_string_literal_lint.py's ALLOWLIST on the incorrect assumpti…

    pgadmin.org pgAdmin 4
  • High 7.5
    CVE-2026-17347

    pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

    The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substi…

    pgadmin.org pgAdmin 4
  • Medium 6.5
    CVE-2026-17348

    pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)

    In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator …

    pgadmin.org pgAdmin 4
  • Medium 5.4
    CVE-2026-17350

    pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

    The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permissi…

    pgadmin.org pgAdmin 4

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-114382

  2. #2

    Neue Updates von openSUSE aufgenommen

  3. #1

    Initiale Fassung

References