Quick answers
- Is CVE-2026-1707 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-1707 being exploited in the wild.
- How severe is CVE-2026-1707?
- Low severity, with a CVSS score of 3.1, published 13 July 2026.
- Which products and versions are affected?
- pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.12.
- Is there a fix for CVE-2026-1707?
- Yes. pgadmin4 (PyPI): upgrade to 9.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-1707 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-1707?
- Check whether you run pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pgadmin4 (PyPI): upgrade to 9.12 or later
pip install "pgadmin4>=9.12"
Technical details
The vulnerability is a cryptographic key disclosure flaw affecting pgAdmin 4's restore functionality in server mode with PLAIN-format dump files. The \restrict key—used to disable dangerous meta-commands during restore operations—is exposed and observable by authenticated users through the web interface. An attacker can perform a race condition attack to overwrite the restore script mid-operation with a payload containing \unrestrict <key> to re-enable meta-commands, achieving reliable remote code execution on the pgAdmin host. The vulnerability affects all versions through 9.11 and is fixed in version 9.12. Exploitation requires authentication and access to the pgAdmin web interface, but no user interaction beyond observing an active restore.
Affected products
- pgAdmin pgAdmin 4 4.20 through 9.11; fixed in 9.12
Identifiers
- CVE-2026-1707
- GHSA-3p7x-94q9-jq9x
- PYSEC-2026-2864
Timeline
- 2026-02-05: disclosed
- 2026-02-05: patched: Fixed in version 9.12