pgAdmin 4 CVE-2026-17348

Exploitation requires pgAdmin 4 to be deployed and running in SERVER mode - desktop mode is explicitly not affected and uses a different authentication model. The pgAdmin web interface must be network-reachable by the attacker; if placed behind a VPN, firewall, or authenticating reverse proxy, the attack surface is eliminated at the network layer. No authentication credentials, session token, or user interaction are required for any of the affected routes. The DELETE constraint route additionally requires knowledge of valid server/database/schema/table identifiers to target a specific constraint, which an attacker could enumerate via the unauthenticated nodes/proplist routes in the same blueprint. The preferences.get_all_cli and session-close routes require no such enumeration. Exploitation is not limited by platform or operating system. The vulnerability does not require any non-default pgAdmin configuration - SERVER mode is the standard deployment for shared or team use.

The CVSS 4.0 base score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a realistic network-accessible, zero-authentication attack surface in a default SERVER mode deployment. Integrity and availability impacts are rated Low (VI:L/VA:L) in the provided vector, though the preferences.get_all_cli route introduces a confidentiality dimension (disclosure of all CLI preference values) not reflected in the provided VC:N assignment - this is a notable gap to verify with the vendor. The vulnerability is a follow-up incomplete-fix of CVE-2026-12046, indicating the defect class was underestimated during initial remediation. No CISA KEV listing and no confirmed public exploit code exist at time of analysis, which moderates immediate exploitation risk. However, the PR:N/AV:N combination means any network-reachable pgAdmin SERVER instance is trivially reachable by this issue, and the DELETE constraint route represents a meaningful integrity threat to production PostgreSQL databases managed through pgAdmin. EPSS data is not provided; given no KEV and no POC, opportunistic exploitation is currently unconfirmed.

An unauthenticated attacker who can reach a pgAdmin 4 SERVER mode web interface over the network sends a crafted HTTP DELETE request to the Constraints delete endpoint, bypassing the missing authentication check and successfully removing a table constraint from a production PostgreSQL database without any credentials. The same attacker can also issue GET requests to the preferences.get_all_cli endpoint to enumerate configuration values, or send DELETE requests to close active debugger or schema-diff sessions belonging to legitimate users, disrupting ongoing database administration work. No public exploit code has been confirmed, but the attack requires only knowledge of the route paths and basic HTTP tooling.