CVE-2026-17348
CVE-2026-17348 is a medium-severity vulnerability in Pgadmin Pgadmin 4 with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v4: 6.9
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-306
- Affected product: Pgadmin Pgadmin 4
- Published:
- Last modified:
Description
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers. This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.
Frequently asked questions
- What is CVE-2026-17348?
- In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers. This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.
- How severe is CVE-2026-17348?
- CVE-2026-17348 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
- Is CVE-2026-17348 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-17348?
- CVE-2026-17348 affects Pgadmin Pgadmin 4. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-17348?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-17348 published?
- CVE-2026-17348 was published on 2026-07-31 and last updated on 2026-08-05.
References
- https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05
- https://github.com/pgadmin-org/pgadmin4/issues/10194
Affected products (1)
- cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*
More vulnerabilities in Pgadmin Pgadmin 4
- CVE-2026-17566 — Critical (CVSS 9.9): pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query…
- CVE-2026-7813 — Critical (CVSS 9.9): Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background…
- CVE-2025-2945 — Critical (CVSS 9.9): Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The…
- CVE-2024-9014 — Critical (CVSS 9.9): pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows…
- CVE-2024-2044 — Critical (CVSS 9.9): pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session…
- CVE-2026-17349 — Critical (CVSS 9.6): /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of…
All CVEs affecting Pgadmin Pgadmin 4 →
Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities
- CVE-2026-20357 — Critical (CVSS 10.0): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team…
- CVE-2026-58115 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running…
- CVE-2026-63508 — Critical (CVSS 10.0): Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to…
- CVE-2026-56163 — Critical (CVSS 10.0): Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to…
- CVE-2026-64812 — Critical (CVSS 10.0): In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
- CVE-2026-60644 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management).…
Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →