Data Exposure Vulnerability in pgAdmin 4 Affected by Improper Server Cloning
CVE-2026-17349

9.3CRITICAL

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
31 July 2026

What is CVE-2026-17349?

A vulnerability in the Workspaces feature of pgAdmin 4 allows a non-owner user to clone another user's shared server, inheriting sensitive database credentials and privileges. When a non-owner triggers an adhoc connect on a shared server, it incorrectly retains the source user’s ownership and credentials, potentially giving the non-owner access to sensitive data. This issue has been addressed in updates, ensuring that any cloned records correctly reflect the caller's user information and remove original credentials, thus preventing unauthorized access.

Affected Version(s)

pgAdmin 4 9.0 < 9.17

References

https://github.com/pgadmin-org/pgadmin4/issues/10200
issue-tracking
https://github.com/pgadmin-org/pgadmin4/commit/a7e74a6ed6...
related
https://github.com/pgadmin-org/pgadmin4/commit/64a9cdbd6a...
patch

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Kundan Sable <kundan.sable@enterprisedb.com>
.