CVE-2026-17348
Full vulnerability record from the local CVENow database.
Description
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers. This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Published
2026-07-31 16:16:59.287000
Last modified
2026-10-23 23:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-17348",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2026-07-31T16:16:59.287",
"lastModified": "2026-10-23T23:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).\n\nA follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.\n\nFix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.\n\nThis issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17."
},
{
"lang": "es",
"value": "En modo SERVIDOR, pgAdmin 4 impone la autenticación por ruta a través del decorador @pga_login_required; el ’hook’ before_request de la aplicación solo maneja el inicio de sesión automático en modo escritorio y la redirección de autenticación Kerberos/servidor web, por lo que cualquier ruta enviada sin el decorador es accesible sin autenticación (CWE-306). Esta es la misma clase de defecto previamente corregida como CVE-2026-12046 (las rutas sqleditor close/update_connection).\n\nUn barrido de seguimiento, impulsado por un informe que describía una corrección incompleta para CVE-2026-12046, encontró más rutas a las que les faltaba @pga_login_required: las rutas ’nodes’ y ’proplist’ (listado de objetos) del ’blueprint’ de Constraints y su ruta ’delete’ (un DELETE que muta el estado y elimina restricciones de tabla); preferences.get_all_cli (GET, revela todos los valores de preferencias configurables por CLI); debugger.close (DELETE); y schema_diff.close (DELETE). Un cliente de red no autenticado podría, por lo tanto, enumerar metadatos de restricciones, eliminar restricciones de tabla, leer valores de preferencias y forzar el cierre de sesiones de depurador o de ’schema-diff’ pertenecientes a otros usuarios, sin autenticarse nunca.\n\nLa corrección añade el decorador @pga_login_required faltante (y la importación correspondiente al módulo Constraints) a cada una de estas rutas. El cambio es solo de decorador; sin cambios de comportamiento en los manejadores subyacentes.\n\nEste problema afecta a pgAdmin 4 en modo SERVIDOR: las rutas Constraints y Debugger desde 1.0, la ruta Schema Diff close desde 4.18, y preferences.get_all_cli desde 8.2, todo antes de 9.17."
}
],
"affected": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"affectedData": [
{
"vendor": "pgadmin.org",
"product": "pgAdmin 4",
"defaultStatus": "unaffected",
"modules": [
"Constraints",
"Debugger"
],
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/constraints/__init__.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/debugger/__init__.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"versions": [
{
"version": "1.0",
"lessThan": "9.17",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "pgadmin.org",
"product": "pgAdmin 4",
"defaultStatus": "unaffected",
"modules": [
"Schema Diff"
],
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/schema_diff/__init__.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"versions": [
{
"version": "4.18",
"lessThan": "9.17",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "pgadmin.org",
"product": "pgAdmin 4",
"defaultStatus": "unaffected",
"modules": [
"Preferences"
],
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/preferences/__init__.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"versions": [
{
"version": "8.2",
"lessThan": "9.17",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-31T17:22:27.726914Z",
"id": "CVE-2026-17348",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*",
"versionStartIncluding": "1.0",
"versionEndExcluding": "9.17",
"matchCriteriaId": "0D8663EF-5416-45B4-9B8D-1F40E3DBC1F7"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/pgadmin-org/pgadmin4/issues/10194",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
]
}
]
}