PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17349 pgadmin.org CVE debrief

The CVE-2026-17349 vulnerability affects pgAdmin 4, specifically the adhoc_connect_server feature introduced in version 9.0. This feature clones a server and copies sensitive information such as user_id, shared, shared_username, and stored credential fields. A non-owner can trigger an adhoc connect against another user's shared server, inheriting the source user's ownership and credentials. The fix ensures that the cloned adhoc record's ownership and stored credential fields belong to the calling user and are cleared before committing. This critical vulnerability allows a non-owner to gain unauthorized access to database credentials, potentially leading to significant data breaches or system compromise. To mitigate this vulnerability, users should immediately upgrade pgAdmin 4 to version 9.17 or later, restrict access to sensitive servers and credentials, monitor for suspicious activity related to adhoc connections, implement additional authentication and authorization checks for server connections, and review and update server configurations to prevent unauthorized access. The CVE record was published on 2026-07-31T16:16:59.480Z and has not been modified since then.

Vendor
pgadmin.org
Product
pgAdmin 4
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-31
Original CVE updated
2026-07-31
Advisory published
2026-07-31
Advisory updated
2026-07-31

Who should care

pgAdmin 4 users, administrators, and anyone with access to sensitive servers and credentials should be aware of this critical vulnerability and take immediate action to upgrade and secure their systems.

Technical summary

The adhoc_connect_server feature in pgAdmin 4 clones a server and copies sensitive information such as user_id, shared, shared_username, and stored credential fields. A non-owner can trigger an adhoc connect against another user's shared server, inheriting the source user's ownership and credentials. The fix ensures that the cloned adhoc record's ownership and stored credential fields belong to the calling user and are cleared before committing.

Defensive priority

This critical vulnerability allows a non-owner to gain unauthorized access to database credentials, potentially leading to significant data breaches or system compromise.

Recommended defensive actions

  • Immediately upgrade pgAdmin 4 to version 9.17 or later
  • Restrict access to sensitive servers and credentials
  • Monitor for suspicious activity related to adhoc connections
  • Implement additional authentication and authorization checks for server connections
  • Review and update server configurations to prevent unauthorized access

Evidence notes

The issue arises from the adhoc_connect_server feature in pgAdmin 4, which clones a server and copies sensitive information such as user_id, shared, shared_username, and stored credential fields. A non-owner can trigger an adhoc connect against another user's shared server, inheriting the source user's ownership and credentials. The fix ensures that the cloned adhoc record's ownership and stored credential fields belong to the calling user and are cleared before committing.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T16:16:59.480Z and has not been modified since then.