Read the docs
TI-2026-14308 Aliases CVE-2026-17348GHSA-rm8j-fq8g-rcjc

Missing authentication in pgadmin.org pgAdmin 4

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers. This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00422 36th percentileScored 2026-11-07
Fix Fixed pgAdmin 4 (pgadmin.org): 9.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgadmin.orgpgAdmin 41.0 to before 9.179.17Patch availableCNA
pgadmin.orgpgAdmin 44.18 to before 9.179.17Patch availableCNA
pgadmin.orgpgAdmin 48.2 to before 9.179.17Patch availableCNA
  • pgAdmin 4 Vendorpgadmin.org Affected 1.0 to before 9.17 Fixed in 9.17 Patch available CNA
  • pgAdmin 4 Vendorpgadmin.org Affected 4.18 to before 9.17 Fixed in 9.17 Patch available CNA
  • pgAdmin 4 Vendorpgadmin.org Affected 8.2 to before 9.17 Fixed in 9.17 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*1.0 to before 9.17Vulnerablepgadmin.org
  • cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions 1.0 to before 9.17 Vulnerable ·pgadmin.org

Remediation

  • Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.17
  • Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.17
  • Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.17

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    pgadmin.org pgAdmin 4 9.17

    6 records Highest priority Priority MEDIUM 3 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-14311 SQL injection in pgadmin.org pgAdmin 4Priority MEDIUM 43
    • TI-2026-14309 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-ownerPriority MEDIUM 42
    • TI-2026-14306 SQL injection in pgadmin.org pgAdmin 4Priority MEDIUM 41
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-17348
  2. 2026-10-03 Alias added: GHSA-rm8j-fq8g-rcjc

References

Patch 2

  • TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
  • TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
  • TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
  • TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
  • TI-2025-02572 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment CVSS 3.1CRITICAL 9.9
  • TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences