Remote code execution affecting pgAdmin 4
A vulnerability affecting pgAdmin 4 would allow an authenticated malicious actor with the “Import/Export Data” permission to inject arbitrary commands and execute code remotely on the server hosting the application.
Description
Technical context and vulnerability details
pgAdmin 4 is a PostgreSQL database administration and development tool. This tool is affected by a vulnerability labeled CVE-2026-17566, resulting from insufficient validation in the parentheses balancing checker used by the data import/export functionality. Exploitation of this vulnerability would allow an authenticated attacker to craft a request that bypasses this validation in order to inject commands and execute arbitrary code with the privileges of the system account running the pgAdmin 4 service on the server. This vulnerability is classified critical with a severity score of 9.9 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Code Execution;
- Breach of confidentiality;
- data integrity and availability;
Affected systems
Products, components and targeted versions
- All versions of pgAdmin 4 prior to version 9.18;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update pgAdmin 4 to version 9.18 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.