Do Son 
TL;DR: The pgAdmin Development Team patched a pgAdmin 4 RCE flaw tracked as CVE-2026-17566, rated CVSS 9.4. Version 9.17 also fixes a credential-cloning bug and an AI Assistant bypass, alongside four other security issues.
- Product: pgadmin.org pgAdmin 4
- Vulnerabilities: 3 flaws (CVE-2026-17566, CVE-2026-17349, CVE-2026-17351)
- Highest severity: 9.9 (Critical · CVSSv3)
- Worst impact: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
- Status: No confirmed exploitation yet; patches available
- Action: Update to 9.18, 9.17 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-17566 | 9.9 | RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) | 9.18 | Not exploited |
| CVE-2026-17349 | 9.6 | Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner | 9.17 | Not exploited |
| CVE-2026-17351 | 9 | AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) | 9.17 | Not exploited |
Why it matters
pgAdmin is the leading open-source graphical tool for managing PostgreSQL databases. A pgAdmin 4 RCE flaw in a widely used admin tool can hand an attacker a foothold on the server hosting the database itself, not just the data inside it.
The most severe issue, CVE-2026-17566, lets an authenticated attacker with a commonly granted permission run arbitrary commands on the server. A separate flaw, CVE-2026-17349, exposes another user’s stored database password by cloning their shared server connection.
How the attacks work
CVE-2026-17566 abuses the Import/Export Data tool. It builds a psql command line by inserting a user-supplied SQL query into a template. A hand-written parenthesis checker failed to match how psql actually parses backslashes, letting a crafted query smuggle a command through psql’s own COPY TO PROGRAM feature.
The checker assumed a backslash before a quote always escapes that quote. PostgreSQL has defaulted to a different string-handling mode since 2010, so the assumption no longer held on any currently supported version.
CVE-2026-17349 lets a non-owner clone another user’s shared server connection and inherit their stored password. CVE-2026-17351 involves the AI Assistant feature. A mismatch between two parsing libraries let a crafted payload smuggle extra SQL statements past a read-only transaction guard.
In the AI Assistant case, the attack does not require a malicious user at all. An attacker can plant the payload inside any document the assistant might read, and the AI relays the crafted query as its own request.
Exploitation status
No public proof-of-concept or in-the-wild exploitation has been confirmed for any of these three CVEs.
Affected versions and patch
The flaws affect pgAdmin 4 versions from 9.0 or earlier through 9.16, depending on the specific CVE. All three are fixed in version 9.17. Administrators should download the patched release from the official pgAdmin site as soon as possible, especially on servers running shared connections or the AI Assistant feature.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
