CVE-2026-17347 pgadmin.org CVE debrief

Who should care

pgAdmin 4 administrators and users, especially those with external authentication sources (OAuth/OIDC claims, Kerberos, webserver auth) and customized MASTER_PASSWORD_HOOK settings, should be aware of this vulnerability and take necessary actions to address it. They should review and update the MASTER_PASSWORD_HOOK setting, restrict the execution of arbitrary commands, and monitor for potential exploitation attempts. Additionally, they should ensure that their systems are updated to a version of pgAdmin 4 that is not affected by this vulnerability.

Technical summary

The MASTER_PASSWORD_HOOK setting in pgAdmin 4, versions 7.2 to 9.17, allows an authenticated user to execute arbitrary commands as the pgAdmin service account by providing a username with shell metacharacters. The issue arises from the previous implementation substituting the username directly into the command string and executing the result with subprocess.Popen(..., shell=True). The fix tokenizes the administrator-configured hook string into an argument vector, substitutes the untrusted username into individual argv elements, and executes with shell=False.

Defensive priority

Authenticated users with specially crafted usernames can execute arbitrary commands as the pgAdmin service account.

Recommended defensive actions

• Review and update the MASTER_PASSWORD_HOOK setting in pgAdmin 4 to ensure it uses the fixed tokenization and execution approach.
• Restrict the execution of arbitrary commands as the pgAdmin service account.
• Monitor for and respond to potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The issue arises from the MASTER_PASSWORD_HOOK setting in pgAdmin 4, versions 7.2 to 9.17. An authenticated user can execute arbitrary commands as the pgAdmin service account by providing a username with shell metacharacters. The fix tokenizes the administrator-configured hook string into an argument vector, substitutes the untrusted username into individual argv elements, and executes with shell=False.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.