# CVE-2026-1707: PYSEC-2026-2864 - pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability

Source: https://junglewise.ai/threats/cve-2026-1707-pgadmin-4-restore-restriction-bypass-via-key-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-1707 · Severity: low · CVSS 3.1 · Published 2026-07-13

pgAdmin 4 is a web-based management tool for PostgreSQL databases. When running in server mode and performing SQL file restores, the application fails to properly mask encryption keys used to restrict dangerous commands. An attacker with web interface access can observe restore operations, extract the restriction key in real time, and inject malicious commands to execute code on the pgAdmin host.

Technologies: [pgadmin4 (PyPI)](https://junglewise.ai/threats/technologies/pgadmin4). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-1707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1707 being exploited in the wild.

**How severe is CVE-2026-1707?** Low severity, with a CVSS score of 3.1, published 13 July 2026.

**Which products and versions are affected?** pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.12.

**Is there a fix for CVE-2026-1707?** Yes. pgadmin4 (PyPI): upgrade to 9.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1707 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-1707?** Check whether you run pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pgadmin4 (PyPI): upgrade to 9.12 or later

  ```sh
  pip install "pgadmin4>=9.12"
  ```


## Technical details

The vulnerability is a cryptographic key disclosure flaw affecting pgAdmin 4's restore functionality in server mode with PLAIN-format dump files. The \restrict key—used to disable dangerous meta-commands during restore operations—is exposed and observable by authenticated users through the web interface. An attacker can perform a race condition attack to overwrite the restore script mid-operation with a payload containing \unrestrict <key> to re-enable meta-commands, achieving reliable remote code execution on the pgAdmin host. The vulnerability affects all versions through 9.11 and is fixed in version 9.12. Exploitation requires authentication and access to the pgAdmin web interface, but no user interaction beyond observing an active restore.

## Affected products

- pgAdmin pgAdmin 4 4.20 through 9.11; fixed in 9.12

## Identifiers

- CVE-2026-1707
- GHSA-3p7x-94q9-jq9x
- PYSEC-2026-2864

## Timeline

- 2026-02-05: disclosed
- 2026-02-05: patched: Fixed in version 9.12

## References

- [https://github.com/pgadmin-org/pgadmin4/issues/9518](https://github.com/pgadmin-org/pgadmin4/issues/9518)

## Related threats

- [PYSEC-2026-1769 - pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability](https://junglewise.ai/threats/cve-2025-9636-pgadmin4-is-affected-by-a-cross-origin-opener-policy-coop)
- [PYSEC-2026-1770 - pgAdmin has Incorrect Default Permissions](https://junglewise.ai/threats/cve-2023-1907-pgadmin-has-incorrect-default-permissions)
- [PYSEC-2026-1775 - OAuth2 client ID and secret exposed through the web browser](https://junglewise.ai/threats/cve-2024-9014-oauth2-client-id-and-secret-exposed-through-the-web-browser)
- [PYSEC-2026-1777 - pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload](https://junglewise.ai/threats/cve-2024-4216-pgadmin-cross-site-scripting-vulnerability-in-settings-store-api)
- [PYSEC-2026-1768 - pgAdmin is affected by a multi-factor authentication bypass vulnerability](https://junglewise.ai/threats/cve-2024-4215-pgadmin-multi-factor-authentication-bypass)