Authorization Vulnerability in pgweb Affected by Custom Connection Strings

CVE-2026-91924

What is CVE-2026-91924?

The pgweb application, up to version 0.17.0, exhibits a serious security flaw where the POST /api/connect endpoint lacks adequate protection when connect-backend authorization is configured. This vulnerability allows attackers to exploit the endpoint by supplying arbitrary database connection strings, enabling them to bypass essential resource-to-database mappings. By leveraging custom session identifiers and connection URLs, malicious actors can gain unauthorized access to sensitive databases and internal services, posing a significant threat to data integrity and confidentiality.

References