CVE-2026-17349
published 2026-07-31CVE-2026-17349: /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server…
PriorityP358critical9.6CVSS 3.1
AVNACLPRLUINSCCHIHAN
EPSS
0.40%
31.4th percentile
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user's (in practice, typically an administrator's) shared server, the clone inherited that user's ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the connection subsequently failed. The non-owner could then open the newly-owned clone and pgAdmin would connect using the source user's stored database password on the non-owner's behalf, granting the non-owner use of database credentials -- and whatever database privileges they confer -- that were never their own.
Fix forces the cloned adhoc record's ownership fields (user_id, shared, shared_username) and stored credential fields (password, save_password, tunnel_password) to belong to the calling user and be cleared/private before committing, regardless of the source server's ownership, sharing state, or stored credentials. A regression test asserts that an adhoc connect triggered by a non-owner against another user's shared server persists a row owned by the caller, not shared, and without the source's stored credentials.
This issue affects pgAdmin 4: from 9.0 before 9.17.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pgadmin.org | pgadmin_4 | >= 9.0 < 9.17 | 9.17 |
| pgadmin | pgadmin_4 | >= 9.0 < 9.17 | 9.17 |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every co
ghsa_unreviewed·2026-07-31
CVE-2026-17349 [CRITICAL] CWE-522 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every co
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user's (in practice, typically an administrator's) shared server, the clone inherited that user's ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the connection subsequently failed. The non-owner could then open the newly-owned clone and p
VulDB
pgAdmin-org pgAdmin up to 9.16 Adhoc Connect Server adhoc_connect_server Server.clone access control
vuldb·2026-07-31·CVSS 9.6
CVE-2026-17349 [CRITICAL] pgAdmin-org pgAdmin up to 9.16 Adhoc Connect Server adhoc_connect_server Server.clone access control
A vulnerability labeled as critical has been found in pgAdmin-org pgAdmin up to 9.16. The affected element is the function Server.clone of the file /misc/workspace/adhoc_connect_server of the component Adhoc Connect Server. Such manipulation leads to improper access controls.
This vulnerability is traded as CVE-2026-17349. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
Red Hat
pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning
vendor_redhat·2026-07-31·CVSS 9.6
CVE-2026-17349 [CRITICAL] CWE-639 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning
pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user's (in practice, typically an administrator's) shared server, the clone inherited that user's ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the co
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-17349 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning [fedora-all]
bugzilla·2026-08-15·CVSS 9.6
CVE-2026-17349 [CRITICAL] CVE-2026-17349 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning [fedora-all]
CVE-2026-17349 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user's (in practice, typically an administrator's)
Bugzilla
CVE-2026-17349 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning
bugzilla·2026-07-31·CVSS 9.6
CVE-2026-17349 [CRITICAL] CVE-2026-17349 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning
CVE-2026-17349 pgadmin4: pgAdmin 4: Unauthorized database credential access via adhoc server cloning
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user's (in practice, typically an administrator's) shared server, the clone inherited that user's ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived e
2026-07-31
Published