CVE-2026-17348: Pgadmin 4 Auth Bypass Vulnerability

CVE-2026-17348 Overview

CVE-2026-17348 is a missing authentication vulnerability in pgAdmin 4 running in SERVER mode. The application enforces authentication per route through the @pga_login_required decorator. Several routes were shipped without this decorator, leaving them reachable by unauthenticated network clients. The affected endpoints span the Constraints blueprint, preferences.get_all_cli, debugger.close, and schema_diff.close. This is the same defect class previously addressed in CVE-2026-12046, and the current CVE resolves an incomplete fix. The vulnerability is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated attackers can enumerate constraint metadata, delete table constraints, read all CLI-settable preference values, and force-close debugger or schema-diff sessions belonging to other users.

Affected Products

pgAdmin 4 Constraints and Debugger routes from version 1.0 before 9.17
pgAdmin 4 Schema Diff close route from version 4.18 before 9.17
pgAdmin 4 preferences.get_all_cli from version 8.2 before 9.17

Discovery Timeline

2026-07-31 - CVE-2026-17348 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-17348

Vulnerability Analysis

pgAdmin 4 enforces authentication on a per-route basis using the @pga_login_required decorator. The application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect. It does not act as a global authentication gate. Any route shipped without the decorator is therefore reachable without authentication.

A follow-up sweep after CVE-2026-12046 identified additional unprotected routes. The Constraints blueprint's nodes and proplist routes expose object listings. The Constraints delete route is a state-mutating DELETE that removes table constraints. preferences.get_all_cli (GET) discloses all CLI-settable preference values. debugger.close (DELETE) and schema_diff.close (DELETE) terminate active sessions.

Root Cause

The root cause is inconsistent enforcement of authentication across the pgAdmin blueprint routes. Authentication depends on developers correctly annotating each handler with @pga_login_required. When decorators are omitted, no upstream middleware compensates. This design pattern creates recurring gaps, as demonstrated by the incomplete fix for CVE-2026-12046.

Attack Vector

An attacker with network access to a pgAdmin 4 instance in SERVER mode issues HTTP requests to the affected endpoints without any session cookie or credentials. The attacker can enumerate constraints, delete constraints from tables, read CLI preferences, and terminate other users' debugger or schema-diff sessions. No user interaction is required.

python

# Security patch: web/pgadmin/preferences/__init__.py
# Adds missing @pga_login_required decorator to get_all_cli endpoint

@blueprint.route("/get_all_cli", methods=["GET"], endpoint='get_all_cli')
@pga_login_required
def get_all_cli():
    """Fetch all preferences for caching."""
    # Load Preferences

# Source: https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05

python

# Security patch: constraints/__init__.py - import added for decorator

from pgadmin.browser.collection import CollectionNodeModule
from pgadmin.utils.ajax import make_json_response, \
    make_response as ajax_response, internal_server_error
from pgadmin.user_login_check import pga_login_required

from config import PG_DEFAULT_DRIVER
from .type import ConstraintRegistry

# Source: https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05

Detection Methods for CVE-2026-17348

Indicators of Compromise

HTTP requests to /preferences/get_all_cli without a valid pgAdmin session cookie
DELETE requests to Constraints delete routes, debugger/close, or schema_diff/close from unauthenticated clients
Unexplained removal of table constraints in PostgreSQL databases managed through pgAdmin
Abrupt termination of debugger or schema-diff sessions reported by legitimate users

Detection Strategies

Inspect pgAdmin access logs for requests to affected endpoints where no authenticated session context is present
Correlate PostgreSQL server logs showing constraint drops with pgAdmin request patterns
Enable verbose logging on the pgAdmin SECURITY_TRACKABLE setting to record request origins

Monitoring Recommendations

Alert on HTTP 200 responses from preferences/get_all_cli originating from clients without prior /login activity
Monitor pgAdmin behind a reverse proxy and log full request URIs plus session headers
Track constraint DDL activity on managed PostgreSQL databases and match against pgAdmin audit trails

How to Mitigate CVE-2026-17348

Immediate Actions Required

Upgrade pgAdmin 4 to version 9.17 or later, which adds @pga_login_required to all affected routes
Restrict network access to pgAdmin SERVER mode instances so they are not exposed to untrusted networks
Review PostgreSQL constraint state on databases managed by exposed pgAdmin instances

Patch Information

The fix is decorator-only and does not change handler behavior. The upstream patch adds @pga_login_required (and the corresponding import in the Constraints module) to the Constraints nodes, proplist, and delete routes, preferences.get_all_cli, debugger.close, and schema_diff.close. Refer to the pgAdmin security commit 24fdcf0 and the issue tracker discussion.

Workarounds

Place pgAdmin behind an authenticating reverse proxy that requires credentials before forwarding requests to any route
Block external access to the affected endpoints (/preferences/get_all_cli, Constraints blueprint paths, debugger/close, schema_diff/close) at the web server or WAF layer
Restrict pgAdmin exposure to a trusted management network or VPN until the upgrade is applied

bash

# Example nginx snippet to require auth on affected endpoints as a workaround
location ~ ^/(preferences/get_all_cli|.*/constraints/.*|debugger/close|schema_diff/close) {
    auth_basic "pgAdmin restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://pgadmin_backend;
}