CVE-2026-17347 in pgAdmin
Summary
by MITRE • 07/31/2026
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (';', '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u.
Fix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell.
This issue affects pgAdmin 4: from 7.2 before 9.17.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability in pgAdmin 4 versions 7.2 through 9.16 represents a critical command injection flaw that arises from improper handling of user input within the MASTER_PASSWORD_HOOK configuration mechanism. This feature was designed to allow administrators to specify external commands that return per-user encryption keys, with the username substituted via the %u placeholder in the configured string. The original implementation directly incorporated user-provided usernames into shell command strings without adequate sanitization, creating a path for authenticated attackers to execute arbitrary code as the pgAdmin service account. The flaw becomes particularly dangerous when user identities originate from external authentication sources such as OAuth/OIDC claims, Kerberos, or webserver authentication mechanisms, where usernames may contain malicious shell metacharacters including semicolons, command substitution syntax, backticks, pipes, logical operators, and newlines that can be exploited to bypass intended security boundaries.
The technical implementation of this vulnerability stems from the dangerous use of subprocess.Popen with shell=True parameter, which allows shell interpretation of constructed command strings. When a username containing shell metacharacters is substituted into the hook string, these characters are interpreted by the underlying shell rather than treated as literal string values, enabling attackers to chain commands or execute arbitrary programs. This type of vulnerability maps directly to CWE-78, known as "Improper Neutralization of Special Elements used in an OS Command," which specifically addresses the risk of command injection when user input is incorporated into system commands without proper sanitization. The attack vector operates through authenticated access, making it particularly concerning since it leverages legitimate administrative configuration features to gain elevated privileges within the application's execution context.
The operational impact of this vulnerability extends beyond simple privilege escalation to potentially compromise entire database infrastructure and sensitive data environments. An attacker with valid authentication credentials can execute arbitrary commands as the pgAdmin service account, which typically runs with sufficient privileges to access database connections and encryption keys. This creates a potential pathway for lateral movement within network environments where pgAdmin is deployed, especially in scenarios where the service account has broader system permissions. The vulnerability affects deployments where administrators have configured external authentication mechanisms, making it particularly relevant in enterprise environments that rely on federated identity management systems. Organizations using pgAdmin 4 with external authentication sources face significant risk since the attack surface expands beyond traditional username validation to include complex shell command injection scenarios.
The fix implemented in pgAdmin 4 version 9.17 addresses the core issue by adopting a more secure approach to command execution through proper argument vector construction. The solution employs shlex module in POSIX-quoting mode to tokenize the administrator-configured hook string into discrete arguments, then substitutes the untrusted username into individual argument elements rather than allowing it to influence the entire shell command structure. This approach completely isolates user input within single argument boundaries, ensuring that shell metacharacters cannot be interpreted as command operators or special shell features. The implementation specifically disables backslash-escaping in shlex to maintain compatibility with Windows-style paths while maintaining security boundaries. This remediation aligns with security best practices outlined in the ATT&CK framework under T1059.001 for Command and Scripting Interpreter, where the mitigation involves preventing injection of shell metacharacters into execution contexts. Administrators must now move any shell-specific logic previously embedded within hook strings into dedicated executable scripts, which requires careful migration planning but provides significantly improved security boundaries. The fix represents a fundamental shift from dangerous shell interpretation to safe argument-based command execution, effectively neutralizing the command injection attack vector while maintaining functional compatibility with existing configurations through proper argument handling.
This vulnerability demonstrates the critical importance of secure coding practices when handling user input in system command contexts and highlights how seemingly legitimate administrative features can become security risks when input validation is insufficient. The remediation approach taken by pgAdmin developers provides a robust solution that aligns with industry standards for preventing command injection attacks while maintaining backward compatibility through clear migration guidance for administrators who relied on shell features within their hook configurations. Organizations should prioritize updating to pgAdmin 4 version 9.17 or later to protect against this specific threat vector, and security teams should review existing MASTER_PASSWORD_HOOK configurations to ensure they do not depend on shell-specific functionality that would now require script-based implementations. The vulnerability serves as a reminder of the ongoing need for comprehensive input validation and secure execution practices in application development, particularly when dealing with user-provided data that may influence system-level operations.