Read the docs
TI-2026-06879 Aliases CVE-2026-7817GHSA-p58c-q354-6c4f

pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints

Priority LOW 31CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-552.

Summary

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints. Fix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point. This issue affects pgAdmin 4: before 9.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Fixed pgAdmin 4 (pgadmin.org): 9.15pgadmin4 (PyPI): 9.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgadmin.orgpgAdmin 49.13 to before 9.159.15Patch availableCNA
—pgadmin4 (PyPI)before 9.159.15Patch availableGHSA-p58c-q354-6c4f
  • pgAdmin 4 Vendorpgadmin.org Affected 9.13 to before 9.15 Fixed in 9.15 Patch available CNA
  • pgadmin4 (PyPI) Vendor— Affected before 9.15 Fixed in 9.15 Patch available GHSA-p58c-q354-6c4f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*9.13 to before 9.15Vulnerablepgadmin.org
  • cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions 9.13 to before 9.15 Vulnerable ·pgadmin.org

Remediation

  • Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.15
  • Fix · GHSA-p58c-q354-6c4f pgadmin4 (PyPI) Fixed in 9.15 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    pgadmin.org pgAdmin 4 9.15

    8 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modePriority HIGH 76
    • TI-2026-06876 pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain VisualizerPriority MEDIUM 55
    • TI-2026-06878 pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutPriority MEDIUM 43
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7817
  2. 2026-10-03 Alias added: GHSA-p58c-q354-6c4f

References

Patch 1

Advisory 1

Other 2

  • TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
  • TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
  • TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
  • TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
  • TI-2025-02572 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment CVSS 3.1CRITICAL 9.9
  • TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences