PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17349 pgadmin.org CVE debrief

The CVE-2026-17349 vulnerability affects pgAdmin 4, specifically the adhoc_connect_server feature introduced in version 9.0. This feature clones a server and copies sensitive information such as user_id, shared, shared_username, and stored credential fields. A non-owner can trigger an adhoc connect against another user's shared server, inheriting the source user's ownership and credentials. The fix ensures that the cloned adhoc record's ownership and stored credential fields belong to the calling user and are cleared before committing. This critical vulnerability allows a non-owner to gain unauthorized access to database credentials, potentially leading to significant data breaches or system compromise. To mitigate this vulnerability, users should immediately upgrade pgAdmin 4 to version 9.17 or later, restrict access to sensitive servers and credentials, monitor for suspicious activity related to adhoc connections, implement additional authentication and authorization checks for server connections, and review and update server configurations to prevent unauthorized access. The CVE record was published on 2026-07-31T16:16:59.480Z and has not been modified since then.

Vendor
pgadmin.org
Product
pgAdmin 4
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-31
Original CVE updated
2026-08-05
Advisory published
2026-07-31
Advisory updated
2026-08-05

Who should care

pgAdmin 4 users, administrators, and anyone with access to sensitive servers and credentials should be aware of this critical vulnerability and take immediate action to upgrade and secure their systems.

Technical summary

The adhoc_connect_server feature in pgAdmin 4 clones a server and copies sensitive information such as user_id, shared, shared_username, and stored credential fields. A non-owner can trigger an adhoc connect against another user's shared server, inheriting the source user's ownership and credentials. The fix ensures that the cloned adhoc record's ownership and stored credential fields belong to the calling user and are cleared before committing.

Defensive priority

This critical vulnerability allows a non-owner to gain unauthorized access to database credentials, potentially leading to significant data breaches or system compromise.

Recommended defensive actions

  • Immediately upgrade pgAdmin 4 to version 9.17 or later
  • Restrict access to sensitive servers and credentials
  • Monitor for suspicious activity related to adhoc connections
  • Implement additional authentication and authorization checks for server connections
  • Review and update server configurations to prevent unauthorized access

Evidence notes

The issue arises from the adhoc_connect_server feature in pgAdmin 4, which clones a server and copies sensitive information such as user_id, shared, shared_username, and stored credential fields. A non-owner can trigger an adhoc connect against another user's shared server, inheriting the source user's ownership and credentials. The fix ensures that the cloned adhoc record's ownership and stored credential fields belong to the calling user and are cleared before committing.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17349 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17349

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17349 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17349

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pgadmin-org/pgadmin4/commit/64a9cdbd6a240a962144f84418beaf9e66419779

    f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pgadmin-org/pgadmin4/commit/a7e74a6ed685bc34e1f77a8b6a94d00fa3dff815

    f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pgadmin-org/pgadmin4/issues/10200

    f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.