CVE-2026-17347
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In pgAdmin 4 from version 7.2 before 9.17, the MASTER_PASSWORD_HOOK setting allowed shell command injection via a username containing shell metacharacters (e.g., ';', '$()', backticks). The username from external auth sources (OAuth, Kerberos) could be used to execute arbitrary commands as the pgAdmin service account.
Risk Assessment
An authenticated user can take over the pgAdmin server by executing arbitrary commands in the context of the service account, leading to full system and data compromise.
Recommendation
Immediately upgrade pgAdmin 4 to version 9.17 or later. If using MASTER_PASSWORD_HOOK, move any shell logic (pipes, redirections) into the invoked script.
Other vulnerabilities in pgAdmin 4
See all- CVE-2026-7819High
There is a path traversal vulnerability using symbolic links in pgAdmin 4 File Manager. An authenticated user can create a symbolic link in their directory pointing outside of it, allowing data to be written to any path accessible by the pgAdmin process.
- CVE-2026-7818High
In pgAdmin 4 FileBackedSessionManager, there is a vulnerability to deserialization of untrusted data, which can lead to remote code execution at the operating system level. This issue arises from the lack of proper integrity checks before deserializing session file contents.
- CVE-2026-7816High
In pgAdmin 4 before version 9.15, there is an OS command injection vulnerability (CWE-78) in the Import/Export query export feature. An authenticated user could inject malicious commands, leading to arbitrary command execution on the pgAdmin server or arbitrary file writes.
- CVE-2026-7815High
A SQL injection vulnerability in the pgAdmin 4 Maintenance Tool allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL commands on the PostgreSQL server. Exploiting this vulnerability could lead to privilege escalation and execution of operating system commands on the database host.
- CVE-2026-17566Critical
A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.
- CVE-2026-17351Critical
A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.
- CVE-2026-17349Critical
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).
- CVE-2026-12048Critical
A stored cross-site scripting vulnerability exists in pgAdmin 4 versions 6.0 through 9.15. Text returned by a PostgreSQL server (e.g., object names in errors or EXPLAIN fields) was passed verbatim to html-react-parser, allowing injection of arbitrary HTML, including iframes. An attacker controlling the server or creating a maliciously named object can hijack the victim's pgAdmin session.
- CVE-2026-12046Critical
In pgAdmin 4 versions 6.9 through 9.15, two SQL Editor endpoints lack authentication decorators, allowing unauthenticated attackers to trigger pickle deserialization from server sessions. Exploitation requires additional preconditions (knowledge of SECRET_KEY and write access to sessions directory) to achieve remote code execution.
- CVE-2026-12045Critical
A vulnerability in the pgAdmin 4 AI Assistant allows an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The flaw stems from missing validation of LLM-generated queries, enabling bypass of read-only mode via injection of commands like COMMIT or ROLLBACK.
Original NVD description (English source)
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (';', '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u. Fix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell. This issue affects pgAdmin 4: from 7.2 before 9.17.