Executive brief
pgAdmin 4 is a popular management tool for PostgreSQL databases. A security flaw in its 'Workspaces' feature allows a regular user to gain unauthorized access to database credentials stored by other users, including administrators. By triggering a specific connection process, an attacker can clone a shared server entry and inherit the original owner's saved passwords, potentially leading to full control over the underlying databases.
Technical details
An authorization bypass exists in the /misc/workspace/adhoc_connect_server endpoint of pgAdmin 4. When an ad-hoc connection is requested for an existing server ID, the application uses Server.clone(), which performs a shallow copy of all database columns including user_id, shared status, and sensitive credential fields (password, save_password, and tunnel_password). Because pgAdmin persists this cloned row before verifying the connection, a low-privileged user can trigger a clone of an administrator's shared server, effectively 're-homing' the administrator's stored credentials to their own account. An attacker can then use the newly owned clone to connect to the database using the victim's saved credentials. The issue is fixed in version 9.17 by ensuring ownership and credential fields are cleared or reset to the calling user during the cloning process.
Affected products
- PostgreSQL pgAdmin 4 9.0 to 9.16
Timeline
- 2026-07-24: other: Issue reported internally
- 2026-07-31: disclosed: CVE published
- 2026-07-31: patched: Fixed in version 9.17
References
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/workspaces/__init__.py
- https://github.com/pgadmin-org/pgadmin4/commit/64a9cdbd6a240a962144f84418beaf9e66419779
- https://github.com/pgadmin-org/pgadmin4/commit/a7e74a6ed685bc34e1f77a8b6a94d00fa3dff815
- https://github.com/pgadmin-org/pgadmin4/issues/10200