CVE-2026-17347 pgadmin.org CVE debrief

Who should care

pgAdmin 4 administrators and users, especially those with external authentication sources (OAuth/OIDC claims, Kerberos, webserver auth) and customized MASTER_PASSWORD_HOOK settings, should be aware of this vulnerability and take necessary actions to address it. They should review and update the MASTER_PASSWORD_HOOK setting, restrict the execution of arbitrary commands, and monitor for potential exploitation attempts. Additionally, they should ensure that their systems are updated to a version of pgAdmin 4 that is not affected by this vulnerability.

Technical summary

The MASTER_PASSWORD_HOOK setting in pgAdmin 4, versions 7.2 to 9.17, allows an authenticated user to execute arbitrary commands as the pgAdmin service account by providing a username with shell metacharacters. The issue arises from the previous implementation substituting the username directly into the command string and executing the result with subprocess.Popen(..., shell=True). The fix tokenizes the administrator-configured hook string into an argument vector, substitutes the untrusted username into individual argv elements, and executes with shell=False.

Defensive priority

Authenticated users with specially crafted usernames can execute arbitrary commands as the pgAdmin service account.

Recommended defensive actions

• Review and update the MASTER_PASSWORD_HOOK setting in pgAdmin 4 to ensure it uses the fixed tokenization and execution approach.
• Restrict the execution of arbitrary commands as the pgAdmin service account.
• Monitor for and respond to potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The issue arises from the MASTER_PASSWORD_HOOK setting in pgAdmin 4, versions 7.2 to 9.17. An authenticated user can execute arbitrary commands as the pgAdmin service account by providing a username with shell metacharacters. The fix tokenizes the administrator-configured hook string into an argument vector, substitutes the untrusted username into individual argv elements, and executes with shell=False.

Official resources