CVE-2026-17348 Missing authorization in pgAdmin 4

Medium 6.9 Published 31 Jul 2026 Updated 31 Jul 2026

Unauthenticated attackers can access specific pgAdmin 4 routes in SERVER mode to read metadata, delete constraints, and close sessions due to missing authentication decorators.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-17348?

CVE-2026-17348 is a medium-severity missing authorization vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).

A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.

Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.

This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.

Weakness: CWE-306

Which versions are affected by CVE-2026-17348?

It affects 1 product.

Products include Pgadmin Pgadmin 4.

How do I fix CVE-2026-17348?

No fix has been published for CVE-2026-17348 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-17348 being exploited?

There is no known exploitation of CVE-2026-17348 in the wild and no public exploit code.

Sources

Also known as GHSA-rm8j-fq8g-rcjc.