Skip to main content

Pgadmin CVE-2026-1707

HIGH
Improper Access Control (CWE-284)
2026-02-05 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 GHSA-3p7x-94q9-jq9x
Authentication Bypass Pgadmin 4 Suse Pgadmin
7.4
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Access pgAdmin web interface
  2. Delivery
    Observe active restore operation
  3. Exploit
    Extract restrict key in real time
  4. Execution
    Race overwrite restore script
  5. Persist
    Execute unrestrict command
  6. Impact
    Achieve code execution on host

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

pgAdmin 9.11 running in server mode with PLAIN-format dump file restore operations. Attacker requires valid web interface credentials (PR:L). Vulnerability exploitable only during active restore window with real-time key observation and script race condition capability.
Impact

CVSS 7.4 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication.
Exploit ScenarioDerived

An attacker (requires authentication) could exploit this flaw, reliable command execution on the pgAdmin host during the re.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Command execution in pgAdmin 4 server mode allows authenticated attackers to bypass restore operation restrictions by extracting the restrict key during PLAIN-format dump file operations and injecting malicious payloads to re-enable meta-commands. An attacker with web interface access can race the restore process in real time to achieve reliable code execution on the pgAdmin host. No patch is currently available for this vulnerability.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 7.4

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. [CVSS 7.4 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affected Packages

pypi pgadmin4 fix: 9.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-284 (Improper Access Control). Affects the web component of Pgadmin 4. pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the \restrict key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using \unrestrict <key>. This results in reliable command ex

Know when Pgadmin gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.4 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
SUSE HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Feb 05, 2026 - 18:16 nvd
HIGH 7.4

DescriptionCVE.org

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the \restrict key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using \unrestrict <key>. This results in reliable command execution on the pgAdmin host during the restore operation.

Executive ViewAI

Why It Matters

pgAdmin 9.11 server installations can be compromised through a restore restriction bypass vulnerability that allows unauthorized database restoration from unencrypted dump files. Organizations running pgAdmin in server mode face potential unauthorized data access and integrity risks until remediation is implemented.

Business Impact: High
Compensating Controls

Restrict network access to pgAdmin restore endpoints via firewall rules; disable restore functionality in pgAdmin server configuration if operationally feasible; implement strict authentication and role-based access controls limiting restore privileges to essential administrators only; monitor restore operations for suspicious activity; segment pgAdmin server from production database networks.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:pgadmin:pgadmin_4:9.11:*:*:*:*:postgresql:*:*

More in Pgadmin

View all
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2024-2044 CRITICAL POC
9.9 Mar 07

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling
CVE-2024-3116 CRITICAL POC
9.8 Apr 04

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. Rated cr
CVE-2022-4223 HIGH POC
8.8 Dec 13

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external Post
CVE-2024-9014 MEDIUM POC
6.5 Sep 23

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. Rated medium severity (CVS
CVE-2025-12762 CRITICAL
9.8 Nov 13

Remote code execution in pgAdmin 4 (versions up to and including 9.9) lets an attacker who can get a crafted PLAIN-forma
CVE-2026-17351 CRITICAL
9.4 Jul 31

SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the

CVE-2026-17566 CRITICAL POC
9.4 Jul 31

OS command injection in pgAdmin 4 (all versions before 9.18) lets an authenticated user with the commonly-granted tools_
CVE-2026-116241 CRITICAL
9.4 Oct 30

Command injection in pgAdmin 4 before 9.19 lets an authenticated, low-privileged database user execute arbitrary operati
CVE-2024-4216 MEDIUM POC
5.4 May 02

pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. Rated medium severity (CVS
CVE-2026-17349 CRITICAL
9.3 Jul 31

Cross-tenant credential theft in pgAdmin 4 (9.0 through 9.16) lets an authenticated non-owner user hijack another user's
CVE-2025-2946 CRITICAL
9.1 Apr 03

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). Rated critical severity (CVSS 9.1

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Python 3 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
REF https://github.com/pgadmin-org/pgadmin4/issues/9518

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy