CVE-2026-1707

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/pgadmin-org/pgadmin4/issues/9518	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:pgadmin:pgadmin_4:9.11:*:*:*:*:postgresql:*:*

History

No history.

Information

Published : 2026-02-05 18:16

Updated : 2026-02-26 22:20

NVD link : CVE-2026-1707

Mitre link : CVE-2026-1707

CVE.ORG link : CVE-2026-1707

JSON object : View

Products Affected

pgadmin

pgadmin_4

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2026-1707", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2026-02-05T18:16:11.180", "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/9518", "tags": ["Issue Tracking"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation."}, {"lang": "es", "value": "Las versiones 9.11 de pgAdmin est\u00e1n afectadas por una vulnerabilidad de omisi\u00f3n de restricci\u00f3n de restauraci\u00f3n mediante divulgaci\u00f3n de clave que ocurre al ejecutarse en modo servidor y al realizar restauraciones desde archivos de volcado en formato PLAIN. Un atacante con acceso a la interfaz web de pgAdmin puede observar una operaci\u00f3n de restauraci\u00f3n activa, extraer la clave '\\restrict' en tiempo real y competir con el proceso de restauraci\u00f3n sobrescribiendo el script de restauraci\u00f3n con una carga \u00fatil que reactiva los metacomandos usando '\\unrestrict '. Esto resulta en una ejecuci\u00f3n de comandos fiable en el host de pgAdmin durante la operaci\u00f3n de restauraci\u00f3n."}], "lastModified": "2026-02-26T22:20:45.413", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:9.11:*:*:*:*:postgresql:*:*", "vulnerable": true, "matchCriteriaId": "3F3F9DF9-ED88-43C6-8164-AC5E57F27DA2"}], "operator": "OR"}]}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}