Credential and ownership leakage via adhoc server clone in pgAdmin 4 (CVE-2026-17349)

In pgAdmin 4 9.0 through 9.16, the `/misc/workspace/adhoc_connect_server` endpoint clones an existing server record using `Server.clone()`, which copies all columns verbatim, including ownership fields (`user_id`, `shared`, `shared_username`) and stored credential fields (`password`, `save_password`, `tunnel_password`). A low-privileged, authenticated user could trigger an adhoc connect against another user's shared server, causing pgAdmin to persist a cross-tenant server row under the attacker's account that retains the source user's stored database and tunnel credentials - even if the connection subsequently fails. The attacker could then use pgAdmin to connect to the database using the victim's saved credentials and inherit whatever database privileges those credentials confer. Affected versions: - pgAdmin 4 >= 9.0, < 9.17 We recommend updating to: pgAdmin 4 9.17. CVSS 9.3 · our assessment: act_now Reference: https://github.com/pgadmin-org/pgadmin4/issues/10200 Details: https://vuln.today/cve/CVE-2026-17349