What is CVE-2026-17349?

CVE-2026-17349 is a critical-severity vulnerability in Pgadmin.org Pgadmin 4, classified under Insufficiently Protected Credentials. CVSS score: 9.6/10. Published 2026-07-31.

How severe is CVE-2026-17349?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in Pgadmin.org Pgadmin 4

CVE-2026-17349

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including use…

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.

Affected products

Pgadmin.org Pgadmin 4 — versions 9.0

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials
CWE-639 — Authorization Bypass Through User-Controlled Key

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (patch)
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (related)
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (issue-tracking)

Frequently asked questions

What is CVE-2026-17349?: CVE-2026-17349 is a critical-severity vulnerability in Pgadmin.org Pgadmin 4, classified under Insufficiently Protected Credentials. CVSS score: 9.6/10. Published 2026-07-31.
How severe is CVE-2026-17349?: Critical severity. CVSS v3 base score is 9.6 out of 10.