CVE-2026-17348 in pgAdmin
Summary
by MITRE • 07/31/2026
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).
A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.
Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.
This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability described represents a critical authentication bypass flaw in pgAdmin 4's server mode implementation, specifically targeting routes that lack proper access control enforcement. This weakness stems from inconsistent application of the @pga_login_required decorator across the codebase, creating a vector for unauthorized access to sensitive administrative functions. The issue falls under CWE-306, which addresses missing authentication checks for critical functions, and demonstrates how incomplete security fixes can leave residual vulnerabilities in software systems. The problem was initially identified and partially addressed through CVE-2026-12046, but subsequent analysis revealed that the remediation was incomplete, leaving several additional routes exposed to unauthenticated access.
The technical flaw manifests in multiple vulnerable endpoints within pgAdmin 4's server mode architecture where authentication requirements are not consistently enforced. The Constraints blueprint exposes routes for node and proplist operations that provide object listing capabilities, along with a delete route that can permanently remove table constraints from databases without proper authorization. Additional vulnerable endpoints include preferences.get_all_cli which reveals all CLI-settable preference values, debugger.close that can terminate debugging sessions belonging to other users, and schema_diff.close which can close schema comparison sessions. These routes operate without requiring authentication despite their privileged nature, creating significant security risks for database administrators who rely on pgAdmin 4 for managing enterprise database environments.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass potential data integrity compromise and information disclosure threats. An unauthenticated attacker could enumerate constraint metadata from database tables, effectively gaining insight into database schema structure without authentication. The ability to delete table constraints represents a direct threat to database consistency and integrity, while the exposure of preference values could reveal sensitive configuration details about the pgAdmin environment. Additionally, forcing closure of debugger and schema-diff sessions allows an attacker to disrupt legitimate administrative activities and potentially interfere with ongoing database management operations. These capabilities align with ATT&CK techniques focused on privilege escalation and reconnaissance through information gathering.
The recommended mitigation strategy involves implementing the missing @pga_login_required decorator across all identified vulnerable routes, along with ensuring proper import statements are included in affected modules such as the Constraints module. This approach maintains the existing functionality of the application while adding the necessary authentication barriers to prevent unauthorized access. The fix is minimal and focused specifically on addressing the authentication enforcement gap rather than modifying underlying business logic or handler behavior, which reduces the risk of introducing new issues while maintaining application stability. The vulnerability affects specific version ranges of pgAdmin 4, with different routes becoming vulnerable in different release versions, indicating that organizations should review their pgAdmin installations against the affected version timeline to determine appropriate upgrade paths.
Security practitioners should note that this vulnerability demonstrates the importance of comprehensive security testing and the need for thorough verification of fixes. The fact that a similar issue was previously addressed but not completely resolved highlights how partial remediations can leave systems vulnerable. Organizations using pgAdmin 4 in server mode must ensure they are running patched versions, particularly those beyond version 9.17 where the complete fix is implemented. This vulnerability also underscores the importance of maintaining consistent security practices across all application components and the necessity of regular security assessments to identify authentication gaps that could be exploited by malicious actors. The issue serves as a reminder that even seemingly minor oversights in access control implementation can create significant security risks in database administration tools that handle sensitive operational data.