Skip to content
OpenAdvisories
High WID-SEC-2026-3446 4 CVEs

pgAdmin: Mehrere Schwachstellen

Published Sep 17, 2026 · Updated Nov 1, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um Dateien zu manipulieren, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

pgAdmin ist eine Verwaltungs- und Entwicklungsplattform für die PostgreSQL-Datenbank.

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-86863

    pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

    pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER fro…

    pgadmin.org pgAdmin 4
  • High 8.8
    CVE-2026-86864

    pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

    pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, whi…

    pgadmin.org pgAdmin 4
  • Medium 6.5
    CVE-2026-86862

    pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

    pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign into a full connection string, and connect…

    pgadmin.org pgAdmin 4
  • Medium 5.9
    CVE-2026-86861

    pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check

    pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously ha…

    pgadmin.org pgAdmin 4

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-114393, EUVD-2026-114391

  2. #1

    Initiale Fassung

References