Is CVE-2026-17349 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17349 being exploited in the wild.

How severe is CVE-2026-17349?

Critical severity, with a CVSS score of 9.6, published 31 July 2026.

Which products and versions are affected?

PostgreSQL pgAdmin 4 9.0 to 9.16.

Is there a fix for CVE-2026-17349?

A patch was published on 2026-07-31: Fixed in version 9.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17349 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-17349?

Check whether you run PostgreSQL pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17349: PostgreSQL pgAdmin 4 credential leak in Workspaces adhoc connection

CVE-2026-17349 · Severity: critical · CVSS 9.6 · Published 2026-07-31

pgAdmin 4 is a popular management tool for PostgreSQL databases. A security flaw in its 'Workspaces' feature allows a regular user to gain unauthorized access to database credentials stored by other users, including administrators. By triggering a specific connection process, an attacker can clone a shared server entry and inherit the original owner's saved passwords, potentially leading to full control over the underlying databases.

Technologies: PostgreSQL pgAdmin 4. Vendors: PostgreSQL.

Quick answers

Is CVE-2026-17349 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17349 being exploited in the wild.
How severe is CVE-2026-17349?: Critical severity, with a CVSS score of 9.6, published 31 July 2026.
Which products and versions are affected?: PostgreSQL pgAdmin 4 9.0 to 9.16.
Is there a fix for CVE-2026-17349?: A patch was published on 2026-07-31: Fixed in version 9.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17349 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-17349?: Check whether you run PostgreSQL pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the /misc/workspace/adhoc_connect_server endpoint of pgAdmin 4. When an ad-hoc connection is requested for an existing server ID, the application uses Server.clone(), which performs a shallow copy of all database columns including user_id, shared status, and sensitive credential fields (password, save_password, and tunnel_password). Because pgAdmin persists this cloned row before verifying the connection, a low-privileged user can trigger a clone of an administrator's shared server, effectively 're-homing' the administrator's stored credentials to their own account. An attacker can then use the newly owned clone to connect to the database using the victim's saved credentials. The issue is fixed in version 9.17 by ensuring ownership and credential fields are cleared or reset to the calling user during the cloning process.

Affected products

PostgreSQL pgAdmin 4 9.0 to 9.16

Timeline

2026-07-24: other: Issue reported internally
2026-07-31: disclosed: CVE published
2026-07-31: patched: Fixed in version 9.17

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.