PT-2026-6603 · Pgadmin · Pgadmin

Akshay-Joshi · Published 2026-02-05 · Updated 2026-02-06 · CVE-2026-1707

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pgAdmin version 9.11

Description pgAdmin version 9.11 is susceptible to a restriction bypass issue during restore operations when running in server mode and processing PLAIN-format dump files. An attacker with access to the pgAdmin web interface can potentially extract the restrict key during an active restore operation. This allows the attacker to race the restore process by overwriting the restore script with a payload that re-enables meta-commands using unrestrict <key>, leading to potential command execution on the pgAdmin host during the restore operation. The vulnerable operation involves restoring from PLAIN-format dump files.

Recommendations Apply a fix or update to a version newer than 9.11. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-639

CWE-284

CWE-200

Related Identifiers

BDU:2026-02533

CVE-2026-1707

GHSA-3P7X-94Q9-JQ9X

Affected Products

Pgadmin

References · 11

• https://bdu.fstec.ru/vul/2026-02533 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1707 · Security Note
• https://osv.dev/vulnerability/GHSA-3p7x-94q9-jq9x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1707 · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/issues/9518 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/62e2d18b0261f88086db65059a6078db07169f18 · Note
• https://twitter.com/CVEnew/status/2019472404381159532 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1qxjol3/resumen_diario_de_vulnerabilidades_06022026 · Reddit Post
• https://advisories.gitlab.com/pkg/pypi/pgadmin4/CVE-2026-1707 · Note
• https://twitter.com/VulmonFeeds/status/2019485297034019171 · Twitter Post