Command Injection Vulnerability in pgAdmin 4 by pgAdmin Organization

CVE-2026-17347

What is CVE-2026-17347?

The MASTER_PASSWORD_HOOK setting in pgAdmin 4 versions from 7.2 to below 9.17 has a command injection vulnerability that allows authenticated users to execute arbitrary commands. This occurs because the implementation directly uses user-supplied usernames, potentially containing shell metacharacters, in an external command execution context. A malicious user can exploit this flaw by manipulating their username derived from external authentication sources like OAuth or Kerberos, leading to unauthorized command execution as the pgAdmin service account. Mitigations have been introduced that tokenize the command string, ensuring that usernames are handled correctly and securely, thus limiting the risk of such attacks.

References