CVE-2026-17349

Gravedad CVSS v4.0:

CRÍTICA

Tipo:

CWE-522 Credenciales insuficientemente protegidas

Fecha de publicación:

31/07/2026

Última modificación:

05/08/2026

Descripción

*** Pendiente de traducción *** /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user&#39;s (in practice, typically an administrator&#39;s) shared server, the clone inherited that user&#39;s ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the connection subsequently failed. The non-owner could then open the newly-owned clone and pgAdmin would connect using the source user&#39;s stored database password on the non-owner&#39;s behalf, granting the non-owner use of database credentials -- and whatever database privileges they confer -- that were never their own.<br /> <br /> Fix forces the cloned adhoc record&#39;s ownership fields (user_id, shared, shared_username) and stored credential fields (password, save_password, tunnel_password) to belong to the calling user and be cleared/private before committing, regardless of the source server&#39;s ownership, sharing state, or stored credentials. A regression test asserts that an adhoc connect triggered by a non-owner against another user&#39;s shared server persists a row owned by the caller, not shared, and without the source&#39;s stored credentials.<br /> <br /> This issue affects pgAdmin 4: from 9.0 before 9.17.

Impacto

Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS v4.0 Severidad y Métricas:

Puntuación base: 9.30 CRÍTICA
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Vector de acceso (AV): A través de red
Complejidad de acceso (AC): Bajo
Attack Requirements (AT): Ninguno
Privilegios Requeridos (PR): Bajo
Interacción del usuario (UI): Ninguno
Confidentiality (VC): Alto
Integrity (VI): Alto
Availability (VA): Ninguno
Confidentiality (SC): Alto
Integrity (SI): Alto
Availability (SA): Ninguno

Puntuación base 4.0

9.30

Gravedad 4.0

CRÍTICA

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS v3.1 Severidad y Métricas:

Puntuación base: 9.60 CRÍTICA
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Vector de acceso (AV): A través de red
Complejidad de acceso (AC): Bajo
Privilegios Requeridos (PR): Bajo
Interacción del usuario (UI): Ninguno
Alcance (S): Modificado
Impacto a la confidencialidad (C): Alto
Impacto a la integridad (I): Alto
Impacto a la disponibilidad (A): Ninguno