# CVE-2026-17348: Missing authorization in pgAdmin 4

> Unauthenticated attackers can access specific pgAdmin 4 routes in SERVER mode to read metadata, delete constraints, and close sessions due to missing authentication decorators.

- **Severity:** Medium 6.9 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 31 Jul 2026
- **Updated:** 31 Jul 2026
- **Also known as:** GHSA-rm8j-fq8g-rcjc

## What is CVE-2026-17348?

CVE-2026-17348 is a medium-severity missing authorization vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).

A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.

Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.

This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.

Weakness: CWE-306 (Missing Authentication for Critical Functionality)

## Which versions are affected by CVE-2026-17348?

It affects 1 product.


Products: Pgadmin Pgadmin 4.

## How do I fix CVE-2026-17348?

No fix has been published for CVE-2026-17348 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-17348 being exploited?

There is no known exploitation of CVE-2026-17348 in the wild and no public exploit code.

## Other vulnerabilities in pgadmin.org pgAdmin 4

- [CVE-2025-2945](https://insights.sbomify.com/CVE-2025-2945/): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment (critical 9.9)
- [CVE-2024-9014](https://insights.sbomify.com/CVE-2024-9014/): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (critical 9.9)
- [CVE-2026-12046](https://insights.sbomify.com/CVE-2026-12046/): Deserialization in pgAdmin 4 (critical 9.5)
- [CVE-2026-17351](https://insights.sbomify.com/CVE-2026-17351/): SQL injection in pgAdmin 4 (critical 9.4)
- [CVE-2026-17566](https://insights.sbomify.com/CVE-2026-17566/): Command injection in pgAdmin 4 (critical 9.4)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-17348 and fix it if it is affected.

What it is: CVE-2026-17348 is a medium-severity missing authorization vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-17348 in the wild and no public exploit code.

Affected product: pgadmin.org pgAdmin 4. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-17348/ (Markdown: https://insights.sbomify.com/CVE-2026-17348/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-17348
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17348
- OSV: https://osv.dev/vulnerability/CVE-2026-17348

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-17348/
Summaries are generated and may contain mistakes; the official description above is the record.