Is CVE-2026-17566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17566 being exploited in the wild.

How severe is CVE-2026-17566?

Critical severity, with a CVSS score of 9.9, published 31 July 2026.

Is there a fix for CVE-2026-17566?

A patch was published on 2026-07-31: Fixed in pgAdmin 4 version 9.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17566 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-17566?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17566: pgAdmin 4 OS command injection in Import/Export Data tool

CVE-2026-17566 · Severity: critical · CVSS 9.9 · Published 2026-07-31

pgAdmin 4, a popular management tool for PostgreSQL databases, contains a vulnerability in its Import/Export Data feature. An attacker with basic user permissions can provide a specially crafted database query that bypasses security checks to execute arbitrary commands on the server hosting pgAdmin. This could lead to a full system takeover, unauthorized data access, or disruption of database operations.

Quick answers

Is CVE-2026-17566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17566 being exploited in the wild.
How severe is CVE-2026-17566?: Critical severity, with a CVSS score of 9.9, published 31 July 2026.
Which products and versions are affected?: pgadmin.org pgAdmin 4 < 9.17.
Is there a fix for CVE-2026-17566?: A patch was published on 2026-07-31: Fixed in pgAdmin 4 version 9.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17566 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-17566?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in pgAdmin 4's Import/Export Data tool. The component constructs a 'psql \copy' command by interpolating user-provided SQL into a Jinja template. A hand-written validation function, _is_query_parens_balanced(), incorrectly handles backslash-escaped single quotes by assuming 'standard_conforming_strings' is disabled. However, in supported PostgreSQL versions (13-18), this setting defaults to 'on', causing psql to treat the backslash as a literal and the subsequent quote as a string terminator. An attacker can exploit this logic discrepancy to break out of the \copy wrapper and inject a 'TO PROGRAM' clause, leading to arbitrary command execution via popen(). The vulnerability is reachable via the POST /import_export/job/<sid> route and requires 'tools_import_export_data' permissions. The fix, introduced in version 9.17, conservatively rejects any backslashes within single-quoted strings in these queries.

Affected products

pgadmin.org pgAdmin 4 < 9.17

Timeline

2026-07-27: disclosed: Reported by Arpit Jain
2026-07-31: patched: Fixed in pgAdmin 4 version 9.17
2026-07-31: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.