Executive brief
pgAdmin 4 is a popular management tool for PostgreSQL databases. In certain configurations, several internal functions were accidentally left accessible to anyone on the network without requiring a password. An unauthorized person could use this to delete database table constraints, view system preferences, or disrupt active debugging sessions, potentially leading to data loss or operational disruption.
Technical details
A missing authentication check (CWE-306) exists in pgAdmin 4 when running in SERVER mode. The application relies on the '@pga_login_required' decorator to enforce authentication on a per-route basis, but several routes were identified as missing this decorator. Specifically, the Constraints blueprint (nodes, proplist, and delete routes), preferences.get_all_cli, debugger.close, and schema_diff.close are affected. An unauthenticated network attacker can exploit these endpoints to enumerate metadata, delete table constraints via state-mutating DELETE requests, or terminate sessions belonging to other users. This issue was addressed in version 9.17 by applying the missing decorators.
Affected products
- pgadmin.org pgAdmin 4 < 9.17
Timeline
- 2026-07-31: advisory: CVE-2026-17348 published
- 2026-07-31: disclosed
References
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/constraints/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/debugger/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/schema_diff/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/preferences/__init__.py
- https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05
- https://github.com/pgadmin-org/pgadmin4/issues/10194