CVE-2026-86864 pgadmin.org CVE debrief

Who should care

System administrators and users with the tools_backup permission in pgAdmin 4 should assess exposure and take action to patch or limit permissions. This includes verifying user permissions, monitoring for suspicious activity, and reviewing system logs. The vulnerability can lead to arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin's own configuration database and, depending on the target chosen

Why it matters

CVE-2026-86864 is a high-severity vulnerability in pgAdmin 4's Backup tool that allows arbitrary file creation and connection-string injection. Users with the tools_backup permission can exploit this vulnerability, which can lead to privilege escalation and credential exposure. System administrators and users with this permission should assess exposure and take action to patch or limit permissions.

• Arbitrary file creation and overwrite as the operating-system account running pgAdmin
• Connection-string injection and potential credential exposure
• Escalation of privileges depending on the target chosen
• Verification of user permissions and system logs required

Technical summary

The pgAdmin 4 Backup tool vulnerability allows arbitrary file creation and connection-string injection due to improper handling of the 'database' field. This issue affects pgAdmin 4 versions before 9.18 and can be exploited by users with the tools_backup permission. The vulnerability arises from the Backup tool's appending of the client-supplied 'database' field to the pg_dump argument vector as a bare trailing positional argument, without validation. This can lead to privilege escalation and credential exposure. The fix involves stopping the passing of the database name through the argument vector and instead supplying it in the PGDATABASE environment variable.

Defensive priority

High priority for patching and verifying exposure

Recommended defensive actions

• Patch pgAdmin 4 to version 9.18 or later
• Verify user permissions and limit tools_backup permission to necessary users
• Monitor for suspicious activity and review system logs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. Additional verification is needed to determine the full scope of affected systems and users. The vulnerability affects pgAdmin 4 versions before 9.18. Users with the tools_backup permission can exploit this vulnerability. The fix matches the approach already used by the Import/Export tool.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.