CVE-2026-1707

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1707

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1707.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1707

Aliases

Published

2026-02-05T17:30:05.089Z

Modified

2026-07-15T01:49:01.442474181Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Summary

Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)

Details

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the \restrict key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using \unrestrict <key>. This results in reliable command execution on the pgAdmin host during the restore operation.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1707.json",
    "cna_assigner": "PostgreSQL"
}

References

Affected packages

Git / github.com/pgadmin-org/pgadmin4

Affected ranges

Type

GIT

Repo

https://github.com/pgadmin-org/pgadmin4

Events

Introduced

dc801e362ebde7fe59ecf77eaaab740fe7452cc5

Last affected

dc801e362ebde7fe59ecf77eaaab740fe7452cc5

Database specific

{
    "cpe": "cpe:2.3:a:pgadmin:pgadmin_4:9.11:*:*:*:*:postgresql:*:*",
    "extracted_events": [
        {
            "introduced": "9.11"
        },
        {
            "last_affected": "9.11"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

9.*

9.11

Other

REL-9_11

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1707.json"