CVE-2026-1707 Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)

High 7.4 Published 5 Feb 2026 Updated 26 Feb 2026

An attacker can bypass restore restrictions in pgAdmin 4 server mode to execute arbitrary commands on the host by racing the restore process.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-1707?

CVE-2026-1707 is a high-severity vulnerability in pgadmin.org pgAdmin 4, published on 5 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.

Weakness: CWE-284

Which versions are affected by CVE-2026-1707?

3 open source packages ship an affected version, including pgadmin4. It affects 1 product.

Package	Affected	Fixed in
`pgadmin4` PyPI	All versions	`9.12`
`pgadmin4` PyPI	All versions	`9.12`
`pgadmin4` PyPI	All versions	`9.12`

Products include Pgadmin Pgadmin 4.

How do I fix CVE-2026-1707?

Upgrade pgadmin4 to 9.12 or later.

Is CVE-2026-1707 being exploited?

There is no known exploitation of CVE-2026-1707 in the wild and no public exploit code.

Sources

Also known as GHSA-3p7x-94q9-jq9x, PYSEC-2026-2864.