CVE-2026-17349

Severity CVSS v4.0:

CRITICAL

Type:

CWE-522 Insufficiently Protected Credentials

Publication date:

31/07/2026

Last modified:

05/08/2026

Description

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user&#39;s (in practice, typically an administrator&#39;s) shared server, the clone inherited that user&#39;s ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the connection subsequently failed. The non-owner could then open the newly-owned clone and pgAdmin would connect using the source user&#39;s stored database password on the non-owner&#39;s behalf, granting the non-owner use of database credentials -- and whatever database privileges they confer -- that were never their own.<br /> <br /> Fix forces the cloned adhoc record&#39;s ownership fields (user_id, shared, shared_username) and stored credential fields (password, save_password, tunnel_password) to belong to the calling user and be cleared/private before committing, regardless of the source server&#39;s ownership, sharing state, or stored credentials. A regression test asserts that an adhoc connect triggered by a non-owner against another user&#39;s shared server persists a row owned by the caller, not shared, and without the source&#39;s stored credentials.<br /> <br /> This issue affects pgAdmin 4: from 9.0 before 9.17.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS v4.0 Severity and Metrics:

Base Score: 9.30 CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): Low
User Interaction (UI): None
Confidentiality (VC): High
Integrity (VI): High
Availability (VA): None
Confidentiality (SC): High
Integrity (SI): High
Availability (SA): None

Base Score 4.0

9.30

Severity 4.0

CRITICAL

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 9.60 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): High
Integrity (I): High
Availability (A): None