pgAdmin 4 EUVD-2026-29085

The vulnerability requires an authenticated user account in pgAdmin 4. The attacker must have credentials to access the pgAdmin web interface and permission to modify LLM configuration settings. The vulnerability is triggered when the chat or model-list endpoints process the configured api_key_file or api_url parameters. The api_key_file path must reference a file readable by the pgAdmin process (typically files with world-readable or group-readable permissions, or files in the same user context). The api_url parameter is vulnerable when set to any arbitrary HTTP/HTTPS address, including cloud metadata services or private infrastructure endpoints. No special deployment configuration is required; default pgAdmin installations with LLM features enabled are vulnerable. The only significant limiting factor is the requirement for prior authentication, which reduces the attack surface compared to unauthenticated exploitation but does not require elevated privileges within pgAdmin.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible exploitation requiring only low-privilege authentication and no user interaction, with high confidentiality impact but no integrity or availability impact. This scoring reflects the dual-vulnerability nature: file read access (high confidentiality) via LFI and SSRF capability to external targets, but no ability to modify or delete data. The authentication requirement (PR:L) significantly limits real-world risk compared to an unauthenticated variant, as it assumes an attacker has already obtained valid pgAdmin credentials. EPSS score is not provided in source data. The vulnerability is particularly dangerous in cloud-hosted or containerized deployments where metadata services (AWS EC2 metadata at 169.254.169.254, GCP metadata server) are accessible from the pgAdmin process, potentially exposing temporary credentials and identity tokens. The fix implemented (path restriction to private storage/home directory, printable-ASCII enforcement, 1024-byte read cap, configurable allowlist) is appropriately scoped and suggests the vendor recognized the severity. KEV (Known Exploited Vulnerability) status is not indicated in provided data. No public proof-of-concept is referenced, though the GitHub issue number (9900) is available for further research.

An attacker with valid pgAdmin credentials (obtained via credential reuse, social engineering, or a separate authentication bypass) logs into pgAdmin and navigates to LLM configuration settings. The attacker modifies the api_key_file field to reference /etc/passwd or other sensitive files readable by the pgAdmin process (such as ~/.pgpass, private SSH keys, or database connection files). When the attacker triggers the chat or model-list endpoint, pgAdmin reads the specified file and returns its contents in the API response or error message, exfiltrating the data. Alternatively, the attacker sets api_url to http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve AWS IAM credentials, or points it to internal services (e.g., database admin interfaces, monitoring dashboards) not exposed to the attacker's network.