OPENSUSE-SU-2026:11508-1
Vulnerability from csaf_opensuse - Published: 2026-08-13 00:00 - Updated: 2026-09-16 21:26Summary
pgadmin4-9.17-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: pgadmin4-9.17-1.1 on GA media
Description of the patch: These are all security issues fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11508
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.8 (High)
Affected products
Recommended
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
9 (Critical)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
critical
9 (Critical)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
critical
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
low
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
moderate
6.3 (Medium)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
7.5 (High)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
9.6 (Critical)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
critical
5.4 (Medium)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
moderate
9 (Critical)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
critical
9.9 (Critical)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
critical
8.8 (High)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
4.8 (Medium)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
8.8 (High)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
moderate
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
8.1 (High)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
20 products, the same list as for
CVE-2026-12044
Threats
Impact
moderate
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "pgadmin4-9.17-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11508",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11508-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12044 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12044/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12045 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12045/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12046 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12046/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12047 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12047/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12048 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12048/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12049 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12049/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12050 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12050/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-1707 page",
"url": "https://www.suse.com/security/cve/CVE-2026-1707/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17347 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17347/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17349 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17349/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17350 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17350/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17351 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17351/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17566 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17566/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7813 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7813/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7815 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7815/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7816 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7816/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7817 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7817/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7818 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7818/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7819 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-7820 page",
"url": "https://www.suse.com/security/cve/CVE-2026-7820/"
}
],
"title": "pgadmin4-9.17-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-16T21:26:03Z",
"generator": {
"date": "2026-08-13T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11508-1",
"initial_release_date": "2026-08-13T00:00:00Z",
"revision_history": [
{
"date": "2026-08-13T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:23:36Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:26:03Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "pgadmin4-9.17-1.1.aarch64",
"product": {
"name": "pgadmin4-9.17-1.1.aarch64",
"product_id": "pgadmin4-9.17-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4@9.17-1.1?arch=aarch64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-desktop-9.17-1.1.aarch64",
"product": {
"name": "pgadmin4-desktop-9.17-1.1.aarch64",
"product_id": "pgadmin4-desktop-9.17-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-desktop@9.17-1.1?arch=aarch64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-doc-9.17-1.1.aarch64",
"product": {
"name": "pgadmin4-doc-9.17-1.1.aarch64",
"product_id": "pgadmin4-doc-9.17-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-doc@9.17-1.1?arch=aarch64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"product": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"product_id": "pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-web-uwsgi@9.17-1.1?arch=aarch64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "system-user-pgadmin-9.17-1.1.aarch64",
"product": {
"name": "system-user-pgadmin-9.17-1.1.aarch64",
"product_id": "system-user-pgadmin-9.17-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/system-user-pgadmin@9.17-1.1?arch=aarch64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "pgadmin4-9.17-1.1.ppc64le",
"product": {
"name": "pgadmin4-9.17-1.1.ppc64le",
"product_id": "pgadmin4-9.17-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4@9.17-1.1?arch=ppc64le\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-desktop-9.17-1.1.ppc64le",
"product": {
"name": "pgadmin4-desktop-9.17-1.1.ppc64le",
"product_id": "pgadmin4-desktop-9.17-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-desktop@9.17-1.1?arch=ppc64le\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-doc-9.17-1.1.ppc64le",
"product": {
"name": "pgadmin4-doc-9.17-1.1.ppc64le",
"product_id": "pgadmin4-doc-9.17-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-doc@9.17-1.1?arch=ppc64le\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"product": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"product_id": "pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-web-uwsgi@9.17-1.1?arch=ppc64le\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "system-user-pgadmin-9.17-1.1.ppc64le",
"product": {
"name": "system-user-pgadmin-9.17-1.1.ppc64le",
"product_id": "system-user-pgadmin-9.17-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/system-user-pgadmin@9.17-1.1?arch=ppc64le\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "pgadmin4-9.17-1.1.s390x",
"product": {
"name": "pgadmin4-9.17-1.1.s390x",
"product_id": "pgadmin4-9.17-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4@9.17-1.1?arch=s390x\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-desktop-9.17-1.1.s390x",
"product": {
"name": "pgadmin4-desktop-9.17-1.1.s390x",
"product_id": "pgadmin4-desktop-9.17-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-desktop@9.17-1.1?arch=s390x\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-doc-9.17-1.1.s390x",
"product": {
"name": "pgadmin4-doc-9.17-1.1.s390x",
"product_id": "pgadmin4-doc-9.17-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-doc@9.17-1.1?arch=s390x\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-web-uwsgi-9.17-1.1.s390x",
"product": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.s390x",
"product_id": "pgadmin4-web-uwsgi-9.17-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-web-uwsgi@9.17-1.1?arch=s390x\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "system-user-pgadmin-9.17-1.1.s390x",
"product": {
"name": "system-user-pgadmin-9.17-1.1.s390x",
"product_id": "system-user-pgadmin-9.17-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/system-user-pgadmin@9.17-1.1?arch=s390x\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "pgadmin4-9.17-1.1.x86_64",
"product": {
"name": "pgadmin4-9.17-1.1.x86_64",
"product_id": "pgadmin4-9.17-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4@9.17-1.1?arch=x86_64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-desktop-9.17-1.1.x86_64",
"product": {
"name": "pgadmin4-desktop-9.17-1.1.x86_64",
"product_id": "pgadmin4-desktop-9.17-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-desktop@9.17-1.1?arch=x86_64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-doc-9.17-1.1.x86_64",
"product": {
"name": "pgadmin4-doc-9.17-1.1.x86_64",
"product_id": "pgadmin4-doc-9.17-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-doc@9.17-1.1?arch=x86_64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"product": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"product_id": "pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/pgadmin4-web-uwsgi@9.17-1.1?arch=x86_64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "system-user-pgadmin-9.17-1.1.x86_64",
"product": {
"name": "system-user-pgadmin-9.17-1.1.x86_64",
"product_id": "system-user-pgadmin-9.17-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:postgresql:pgadmin_4:9.17:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/system-user-pgadmin@9.17-1.1?arch=x86_64\u0026upstream=pgadmin4-9.17-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-9.17-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64"
},
"product_reference": "pgadmin4-9.17-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-9.17-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le"
},
"product_reference": "pgadmin4-9.17-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-9.17-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x"
},
"product_reference": "pgadmin4-9.17-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-9.17-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64"
},
"product_reference": "pgadmin4-9.17-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-desktop-9.17-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64"
},
"product_reference": "pgadmin4-desktop-9.17-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-desktop-9.17-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le"
},
"product_reference": "pgadmin4-desktop-9.17-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-desktop-9.17-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x"
},
"product_reference": "pgadmin4-desktop-9.17-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-desktop-9.17-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64"
},
"product_reference": "pgadmin4-desktop-9.17-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-doc-9.17-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64"
},
"product_reference": "pgadmin4-doc-9.17-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-doc-9.17-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le"
},
"product_reference": "pgadmin4-doc-9.17-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-doc-9.17-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x"
},
"product_reference": "pgadmin4-doc-9.17-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-doc-9.17-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64"
},
"product_reference": "pgadmin4-doc-9.17-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64"
},
"product_reference": "pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le"
},
"product_reference": "pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x"
},
"product_reference": "pgadmin4-web-uwsgi-9.17-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pgadmin4-web-uwsgi-9.17-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64"
},
"product_reference": "pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "system-user-pgadmin-9.17-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64"
},
"product_reference": "system-user-pgadmin-9.17-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "system-user-pgadmin-9.17-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le"
},
"product_reference": "system-user-pgadmin-9.17-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "system-user-pgadmin-9.17-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x"
},
"product_reference": "system-user-pgadmin-9.17-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "system-user-pgadmin-9.17-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
},
"product_reference": "system-user-pgadmin-9.17-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12044",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12044"
}
],
"notes": [
{
"category": "general",
"text": "SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS \u0027\u003cdescription\u003e\u0027`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description directly inside a single-quoted SQL literal -- ``\u0027{{ data.description }}\u0027`` -- instead of passing it through the ``qtLiteral`` escape filter. An authenticated pgAdmin user with permission to create or alter the affected object types could submit a description containing an apostrophe, break out of the literal and chain arbitrary SQL. The injected SQL runs under the PostgreSQL role the user is already authenticated as; for a connected role with ``COPY ... TO/FROM PROGRAM`` (typically PostgreSQL superuser), this chains to OS command execution on the PostgreSQL host. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through pgAdmin\u0027s Query Tool -- so the attacker gains no capability beyond what their database role already grants. The marginal impact captures bypass of any application-layer Query Tool gating an operator may have configured.\n\nThe defect was originally reported against the Domain Dialog ``description`` field; a code-wide audit identified sixteen sites of the same pattern across the templates listed above. The same review also surfaced ten related sinks in the pgstattuple/pgstatindex stats templates -- ``pgstattuple(\u0027{{schema}}.{{table}}\u0027)`` and the matching pgstatindex shape -- where ``qtIdent`` escapes embedded double quotes inside the identifier but not apostrophes, so a user with CREATE privilege on a schema could plant a table or index named ``foo\u0027bar`` and a later stats viewer would render an unbalanced literal.\n\nFix is layered:\n\n 1. Sites: replace every ``\u0027{{ x.description }}\u0027`` with ``{{ x.description|qtLiteral(conn) }}`` (no surrounding quotes -- the filter wraps the value in escaped quotes itself). Plumb ``conn=self.conn`` through every ``render_template`` call that loads one of these templates. Also corrects a ``{ % elif`` Jinja typo in the foreign-table schema diff (dead branch). Rewrite the ten pgstattuple/pgstatindex stats sites to address the relation via OID + ``::oid::regclass`` cast (e.g. ``pgstattuple({{ tid }}::oid::regclass)``), eliminating the embedded literal-call form entirely so that bug-class can no longer recur there.\n\n 2. Driver hardening: ``qtLiteral`` (in ``utils/driver/psycopg3/__init__.py``) used to silently return the raw unescaped value when its ``conn`` argument was falsy. It now raises ``ValueError`` -- surfacing the entire bug class going forward. The change immediately uncovered eight latent plumbing bugs (in ``schemas/__init__.py``, ``schemas/functions/__init__.py``, ``schemas/tables/utils.py``, ``foreign_servers/__init__.py``, and seven sites in ``roles/__init__.py``) -- all fixed as part of this patch. The inner ``except`` block that swallowed adapter-level failures and returned the raw value is also removed, so unadaptable inputs raise instead of leaking unescaped values.\n\n 3. Regression tests: a per-template behavioural test renders each previously-vulnerable template with an apostrophe-injection payload and asserts the escaped fragment is present and the vulnerable fragment absent; a lint test walks every ``*.sql`` template flagging any ``\u0027{{ ... }}\u0027`` single-quote-wrapped interpolation against an explicit allowlist; unit tests cover the new qtLiteral fail-fast and inner-except raise paths.\n\nThis issue affects pgAdmin 4: from 1.0 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12044",
"url": "https://www.suse.com/security/cve/CVE-2026-12044"
},
{
"category": "external",
"summary": "SUSE Bug 1268563 for CVE-2026-12044",
"url": "https://bugzilla.suse.com/1268563"
},
{
"category": "external",
"summary": "SUSE Bug 1273263 for CVE-2026-12044",
"url": "https://bugzilla.suse.com/1273263"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-12044"
},
{
"cve": "CVE-2026-12045",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12045"
}
],
"notes": [
{
"category": "general",
"text": "Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user\u0027s database role.\n\nThe AI Assistant\u0027s execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.\n\nDelivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user\u0027s role the attacker can perform unauthorised data modification. When the pgAdmin user\u0027s role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.\n\nFix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL\u0027s READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects.\n\nThis issue affects pgAdmin 4: from 9.13 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12045",
"url": "https://www.suse.com/security/cve/CVE-2026-12045"
},
{
"category": "external",
"summary": "SUSE Bug 1268564 for CVE-2026-12045",
"url": "https://bugzilla.suse.com/1268564"
},
{
"category": "external",
"summary": "SUSE Bug 1273269 for CVE-2026-12045",
"url": "https://bugzilla.suse.com/1273269"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-12045"
},
{
"cve": "CVE-2026-12046",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12046"
}
],
"notes": [
{
"category": "general",
"text": "Two state-mutating endpoints in pgAdmin 4\u0027s SQL Editor blueprint -- DELETE /sqleditor/close/\u003ctrans_id\u003e and POST /sqleditor/initialize/sqleditor/update_connection/\u003csgid\u003e/\u003csid\u003e/\u003cdid\u003e -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session[\u0027gridData\u0027][\u003ctrans_id\u003e][\u0027command_obj\u0027]: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.\n\nThe defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin\u0027s Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin\u0027s sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.\n\nFix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path.\n\nThe defect is server-mode only. In DESKTOP mode pgAdmin\u0027s before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker\u0027s path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests.\n\nThis issue affects pgAdmin 4: from 6.9 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12046",
"url": "https://www.suse.com/security/cve/CVE-2026-12046"
},
{
"category": "external",
"summary": "SUSE Bug 1268568 for CVE-2026-12046",
"url": "https://bugzilla.suse.com/1268568"
},
{
"category": "external",
"summary": "SUSE Bug 1273266 for CVE-2026-12046",
"url": "https://bugzilla.suse.com/1273266"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-12046"
},
{
"cve": "CVE-2026-12047",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12047"
}
],
"notes": [
{
"category": "general",
"text": "HTML injection in pgAdmin 4\u0027s cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and the top-level /cloud/ blueprint propagated AWS / Azure / Google SDK exception text - and the related file-resolution and database-commit exception text - into the JSON response body (the info and errormsg fields) without HTML-encoding. The Cloud Wizard frontend rendered these strings through html-react-parser, so an attacker-influenced exception message embedded structural HTML directly into the wizard\u0027s DOM.\n\nThe reported entry point is /rds/verify_credentials/. An authenticated pgAdmin user submits a crafted access_key whose value contains an \u003ciframe/src=...\u003e payload; AWS STS rejects the credential with an IncompleteSignature exception whose text quotes the access_key verbatim; the pgAdmin backend forwards that text into the JSON info field; the Cloud Wizard\u0027s FormFooterMessage parses it as HTML. The browser fetches the iframe\u0027s src from an attacker-controlled host, and JavaScript executing inside the cross-origin iframe writes to parent.location, redirecting the victim\u0027s pgAdmin tab. Because the injection renders inside pgAdmin\u0027s own interface, X-Frame-Options and Content-Security-Policy frame-ancestors do not mitigate it. Baseline impact is self-targeted (the same user who supplied the payload sees the injection); escalation against other authenticated users requires an additional cross-site request-forgery primitive capable of submitting the malformed credential request with a valid X-pgA-CSRFToken in the victim\u0027s browser context.\n\nThe same unsanitised-error-into-JSON pattern was present across multiple sibling endpoints - Azure\u0027s check_cluster_name_availability, every Google endpoint that surfaces SDK errors (verification_ack, projects, regions, instance_types, database_versions, the verify_credentials path-resolution branches), the central /deploy endpoint that bubbles str(e) from deploy_on_rds / deploy_on_azure / deploy_on_google, and update_cloud_server which surfaces the str(e) from a failing db.session.commit - all of which are now covered.\n\nFix HTML-escapes every external/SDK exception string at the endpoint sink via a new shared sanitize_external_text helper (HTML escape with control-character strip), promoted out of the psycopg3 driver into web/pgadmin/utils/text_sanitize.py. The Cloud Wizard frontend additionally renders its FormFooterMessage in plain-text mode for backend-derived strings, so the value is never parsed as HTML even if a future sink forgets the escape.\n\nThis issue affects pgAdmin 4: from 6.6 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12047",
"url": "https://www.suse.com/security/cve/CVE-2026-12047"
},
{
"category": "external",
"summary": "SUSE Bug 1268580 for CVE-2026-12047",
"url": "https://bugzilla.suse.com/1268580"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2026-12047"
},
{
"cve": "CVE-2026-12048",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12048"
}
],
"notes": [
{
"category": "general",
"text": "Stored cross-site scripting in pgAdmin 4\u0027s error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink - the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser\u0027s NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls - or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create - could inject arbitrary HTML (including \u003ciframe\u003e) into the pgAdmin DOM the moment the victim\u0027s pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.\n\nThe injected iframe\u0027s srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim\u0027s top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin\u0027s own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog.\n\nFix combines three complementary layers. (1) DOMPurify sanitisation is wrapped around every html-react-parser call site reachable from notifier, alert, form-error, Explain, and SQL-editor flows. (2) A new plain-text rendering contract - SafeMessage / SafeHtmlMessage components plus Notifier.errorText / alertText / warningText / infoText / successText helpers - is introduced; around fifty callers across browser, tools, dashboard, debugger, misc, llm, preferences, schema diff, and the SQL editor that previously interpolated backend-derived strings are migrated to the plain-text variants. (3) Backend HTML-escape is applied at the post-connection-SQL handler (execute_post_connection_sql) via a new sanitize_external_text helper, so third-party JSON consumers (audit logs, API clients) never receive raw markup either; the Explain plan-info renderer is also patched to _.escape Recheck Cond and Exact Heap Blocks at construction (matching every sibling field), giving defence in depth even before DOMPurify runs.\n\nThis issue affects pgAdmin 4: from 6.0 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12048",
"url": "https://www.suse.com/security/cve/CVE-2026-12048"
},
{
"category": "external",
"summary": "SUSE Bug 1268581 for CVE-2026-12048",
"url": "https://bugzilla.suse.com/1268581"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-12048"
},
{
"cve": "CVE-2026-12049",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12049"
}
],
"notes": [
{
"category": "general",
"text": "Open redirect in pgAdmin 4\u0027s multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied \u0027next\u0027 query/form parameter without confirming the target pointed back inside pgAdmin, so an authenticated victim who clicked /mfa/validate?next=\u003cexternal\u003e -- a link typically delivered by phishing -- would be sent to an attacker-controlled host directly out of the trusted auth flow.\n\nThe defect is a trusted-domain redirect, not a privilege bypass: the attacker gains no read/write access to pgAdmin or the victim\u0027s database, but the redirect launders the attacker\u0027s destination through pgAdmin\u0027s URL, which raises the success rate of credential-phishing follow-on against the victim.\n\nFix introduces a same-origin _is_safe_redirect_url helper and gates every MFA redirect that consumes user-supplied \u0027next\u0027 values through it. The helper allows only relative paths and absolute URLs whose scheme is http(s) and whose host matches the current request host; it rejects external hosts in absolute and protocol-relative form, non-http schemes (javascript:, data:, mailto:), userinfo tricks (http://localhost@attacker/), and backslash variants that some browsers normalize to forward slashes. Unsafe targets fall back to the internal browser index. A dedicated regression test exercises each accept/reject category and the original reporter PoC.\n\nThis issue affects pgAdmin 4: from 6.0 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12049",
"url": "https://www.suse.com/security/cve/CVE-2026-12049"
},
{
"category": "external",
"summary": "SUSE Bug 1268584 for CVE-2026-12049",
"url": "https://bugzilla.suse.com/1268584"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-12049"
},
{
"cve": "CVE-2026-12050",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12050"
}
],
"notes": [
{
"category": "general",
"text": "SQL injection in pgAdmin 4\u0027s named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied \u0027value\u0027 field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.\n\nThe injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.\n\nFix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.\n\nThis issue affects pgAdmin 4: from 1.0 before 9.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12050",
"url": "https://www.suse.com/security/cve/CVE-2026-12050"
},
{
"category": "external",
"summary": "SUSE Bug 1268586 for CVE-2026-12050",
"url": "https://bugzilla.suse.com/1268586"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-12050"
},
{
"cve": "CVE-2026-1707",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-1707"
}
],
"notes": [
{
"category": "general",
"text": "pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\\unrestrict \u003ckey\u003e`. This results in reliable command execution on the pgAdmin host during the restore operation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-1707",
"url": "https://www.suse.com/security/cve/CVE-2026-1707"
},
{
"category": "external",
"summary": "SUSE Bug 1257779 for CVE-2026-1707",
"url": "https://bugzilla.suse.com/1257779"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-1707"
},
{
"cve": "CVE-2026-17347",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17347"
}
],
"notes": [
{
"category": "general",
"text": "The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user\u0027s name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (\u0027;\u0027, \u0027$()\u0027, backticks, pipes, \u0027\u0026\u0026\u0027, newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u.\n\nFix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell.\n\nThis issue affects pgAdmin 4: from 7.2 before 9.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17347",
"url": "https://www.suse.com/security/cve/CVE-2026-17347"
},
{
"category": "external",
"summary": "SUSE Bug 1273265 for CVE-2026-17347",
"url": "https://bugzilla.suse.com/1273265"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-17347"
},
{
"cve": "CVE-2026-17349",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17349"
}
],
"notes": [
{
"category": "general",
"text": "/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against another user\u0027s (in practice, typically an administrator\u0027s) shared server, the clone inherited that user\u0027s ownership, shared flag, and stored database credentials verbatim. pgAdmin persisted this cross-tenant, credential-bearing server row before the connection was even attempted, so it survived even when the connection subsequently failed. The non-owner could then open the newly-owned clone and pgAdmin would connect using the source user\u0027s stored database password on the non-owner\u0027s behalf, granting the non-owner use of database credentials -- and whatever database privileges they confer -- that were never their own.\n\nFix forces the cloned adhoc record\u0027s ownership fields (user_id, shared, shared_username) and stored credential fields (password, save_password, tunnel_password) to belong to the calling user and be cleared/private before committing, regardless of the source server\u0027s ownership, sharing state, or stored credentials. A regression test asserts that an adhoc connect triggered by a non-owner against another user\u0027s shared server persists a row owned by the caller, not shared, and without the source\u0027s stored credentials.\n\nThis issue affects pgAdmin 4: from 9.0 before 9.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17349",
"url": "https://www.suse.com/security/cve/CVE-2026-17349"
},
{
"category": "external",
"summary": "SUSE Bug 1273267 for CVE-2026-17349",
"url": "https://bugzilla.suse.com/1273267"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-17349"
},
{
"cve": "CVE-2026-17350",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17350"
}
],
"notes": [
{
"category": "general",
"text": "The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator (permissions_required) was applied only to a single \"front door\" route per tool. Every other backend route and Socket.IO handler in that tool\u0027s workflow relied solely on pga_login_required/socket_login_required, which check authentication but not the tool permission.\n\nThe reporter verified three cases against a test build: (1) a user without tools_query_tool permission received 403 on the protected sqleditor initialization route, but the same session went on to connect the server, initialize the viewdata backend chain, and retrieve real table row content; (2) a user without tools_grant_wizard received 403 on the protected acl route, but the same session still enumerated grantable objects, generated GRANT SQL, and successfully applied it -- confirmed database-side via has_table_privilege(); (3) a user without tools_schema_diff received 403 on the protected panel route, but the same session initialized schema diff, enumerated and connected databases, and obtained real DDL differences via the compare_database Socket.IO handler. The reporter also confirmed a related but distinct issue: a non-owner triggering /misc/workspace/adhoc_connect_server against an administrator-owned shared server caused pgAdmin to persist a new server row still owned by the administrator (user_id/shared unchanged from the source), even though the connection attempt itself reported failure.\n\nDuring remediation, the same front-door-only permission gap was found to also affect the ERD, PSQL, and Debugger tools, and the Backup, Restore, Maintenance, and Import/Export blueprints, none of which were part of the original report; these were fixed using the same pattern as an extension of the reported defect class.\n\nAn authenticated user who had valid pgAdmin login and a stored, working database connection, but had been explicitly denied a specific tool\u0027s permission by an administrator, could therefore still drive that tool end-to-end through its other routes and sockets, including obtaining an interactive psql session over the /pty Socket.IO namespace and invoking backup/restore/maintenance/import-export jobs.\n\nBecause the bypass only restores access to tools operating over the user\u0027s own already-authenticated database connection, it does not grant the user any database privilege they did not already hold; it circumvents pgAdmin\u0027s own tool-level access-control policy (an organisational segregation-of-duties control, separate from database-level authorization), letting a user reach a pgAdmin feature an administrator intended to withhold from them, using capabilities their existing database role already permits through other means.\n\nSocket.IO event handlers had no permission-aware equivalent of permissions_required; only socket_login_required existed, checking authentication but not the tool permission.\n\nFix adds a socket_permissions_required decorator (mirroring permissions_required, honouring the Administrator bypass, reading permissions via has_permission()) and applies it, alongside permissions_required, as the outermost decorator on every backend route and Socket.IO handler for the affected tools. Regression tests assert 403 on every gated route and socket handler for a permission-less user.\n\nThis issue affects pgAdmin 4 in SERVER mode: from 9.3 before 9.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17350",
"url": "https://www.suse.com/security/cve/CVE-2026-17350"
},
{
"category": "external",
"summary": "SUSE Bug 1273268 for CVE-2026-17350",
"url": "https://bugzilla.suse.com/1273268"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-17350"
},
{
"cve": "CVE-2026-17351",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17351"
}
],
"notes": [
{
"category": "general",
"text": "The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant\u0027s execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse\u0027s string-literal lexing can disagree with PostgreSQL\u0027s own parser: under standard_conforming_strings = on (PostgreSQL\u0027s default since 9.1), a backslash immediately before a quote is an ordinary character to PostgreSQL, but sqlparse treats it as escaping the quote. A payload such as SELECT \u0027\\\u0027;COMMIT;CREATE TABLE pwn(x int);SELECT 1 --\u0027 therefore parses as a single SELECT to sqlparse\u0027s validator, while PostgreSQL executes it as four statements: the smuggled COMMIT ends the wrapping read-only transaction, and the trailing ROLLBACK becomes a no-op. This reintroduces the same write/RCE bypass CVE-2026-12045 was meant to close, reachable via the same indirect prompt-injection delivery (an attacker plants the payload in any object the AI Assistant may read; the LLM emits it as a tool call).\n\nAn initial candidate fix ran the query with psycopg\u0027s execute(..., prepare=True), intending to force PostgreSQL\u0027s own Parse step (extended query protocol) to reject multi-statement text regardless of sqlparse\u0027s classification. This candidate fix does not work as submitted: psycopg3\u0027s PrepareManager silently ignores the prepare argument whenever the connection\u0027s prepare_threshold is None, which is pgAdmin\u0027s default for every server connection (the per-server \"Prepare threshold\" field is blank unless an administrator explicitly sets it) -- psycopg3 falls back to the simple query protocol, the same multi-statement-capable path the bypass exploits, so the candidate fix closes nothing on any real-world default configuration.\n\nThe corrected fix sets conn.prepare_threshold = 0 directly on the dedicated, single-use read-only connection the AI Assistant tool opens, structurally forcing the extended query protocol independent of any server-level configuration. Verified against a live PostgreSQL 18 instance: the payload executes successfully under the prepare_threshold=None (default) behavior, and is rejected with \"cannot insert multiple commands into a prepared statement\" once prepare_threshold=0 is set on that connection.\n\nThis issue affects pgAdmin 4: from 9.13 before 9.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17351",
"url": "https://www.suse.com/security/cve/CVE-2026-17351"
},
{
"category": "external",
"summary": "SUSE Bug 1273269 for CVE-2026-17351",
"url": "https://bugzilla.suse.com/1273269"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-17351"
},
{
"cve": "CVE-2026-17566",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17566"
}
],
"notes": [
{
"category": "general",
"text": "pgAdmin 4\u0027s Import/Export Data tool builds a psql \\copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/\u003csid\u003e, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\\\u0027) as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql\u0027s own \\copy tokenizer treats \\ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT \u0027a\\\u0027) TO PROGRAM \u0027echo pwned\u0027 x\u0027 was therefore accepted as \"balanced\" by pgAdmin\u0027s checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \\copy (...) subquery, exposing an attacker-chosen TO PROGRAM \u0027\u003ccommand\u003e\u0027 clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor).\n\nThe fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \\ depends on the target server\u0027s standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing.\n\nThis issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17566",
"url": "https://www.suse.com/security/cve/CVE-2026-17566"
},
{
"category": "external",
"summary": "SUSE Bug 1273270 for CVE-2026-17566",
"url": "https://bugzilla.suse.com/1273270"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-17566"
},
{
"cve": "CVE-2026-7813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7813"
}
],
"notes": [
{
"category": "general",
"text": "Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.\n\nMultiple endpoints fetched user-owned objects without filtering by the requesting user\u0027s identity. An authenticated user could access another user\u0027s private servers, server groups, background processes, and debugger function arguments by guessing object IDs.\n\nAdditionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner\u0027s process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner\u0027s record.\n\nFix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7813",
"url": "https://www.suse.com/security/cve/CVE-2026-7813"
},
{
"category": "external",
"summary": "SUSE Bug 1265043 for CVE-2026-7813",
"url": "https://bugzilla.suse.com/1265043"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-7813"
},
{
"cve": "CVE-2026-7814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7814"
}
],
"notes": [
{
"category": "general",
"text": "Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.\n\nUser-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object.\n\nFix replaces innerHTML with textContent.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7814",
"url": "https://www.suse.com/security/cve/CVE-2026-7814"
},
{
"category": "external",
"summary": "SUSE Bug 1265038 for CVE-2026-7814",
"url": "https://bugzilla.suse.com/1265038"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-7814"
},
{
"cve": "CVE-2026-7815",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7815"
}
],
"notes": [
{
"category": "general",
"text": "SQL injection vulnerability in pgAdmin 4 Maintenance Tool.\n\nFour user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.\n\nFix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7815",
"url": "https://www.suse.com/security/cve/CVE-2026-7815"
},
{
"category": "external",
"summary": "SUSE Bug 1265021 for CVE-2026-7815",
"url": "https://bugzilla.suse.com/1265021"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-7815"
},
{
"cve": "CVE-2026-7816",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7816"
}
],
"notes": [
{
"category": "general",
"text": "OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.\n\nUser-supplied input was interpolated directly into a psql \\copy metacommand template without sanitization. An authenticated user could inject \") TO PROGRAM \u0027cmd\u0027\" to break out of the \\copy (...) context and achieve arbitrary command execution on the pgAdmin server, or \") TO \u0027/path\u0027\" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.\n\nFix adds a parens-balance parser modeled on psql\u0027s strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7816",
"url": "https://www.suse.com/security/cve/CVE-2026-7816"
},
{
"category": "external",
"summary": "SUSE Bug 1265016 for CVE-2026-7816",
"url": "https://bugzilla.suse.com/1265016"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-7816"
},
{
"cve": "CVE-2026-7817",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7817"
}
],
"notes": [
{
"category": "general",
"text": "Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.\n\nUser-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.\n\nFix restricts api_key_file to the user\u0027s private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7817",
"url": "https://www.suse.com/security/cve/CVE-2026-7817"
},
{
"category": "external",
"summary": "SUSE Bug 1265015 for CVE-2026-7817",
"url": "https://bugzilla.suse.com/1265015"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-7817"
},
{
"cve": "CVE-2026-7818",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7818"
}
],
"notes": [
{
"category": "general",
"text": "Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.\n\nThe session manager performed unsafe deserialization of session-file contents (using Python\u0027s standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.\n\nFix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7818",
"url": "https://www.suse.com/security/cve/CVE-2026-7818"
},
{
"category": "external",
"summary": "SUSE Bug 1265014 for CVE-2026-7818",
"url": "https://bugzilla.suse.com/1265014"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-7818"
},
{
"cve": "CVE-2026-7819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7819"
}
],
"notes": [
{
"category": "general",
"text": "Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.\n\ncheck_access_permission used os.path.abspath, which resolves \u0027..\u0027 but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.\n\nFix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600.\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7819",
"url": "https://www.suse.com/security/cve/CVE-2026-7819"
},
{
"category": "external",
"summary": "SUSE Bug 1265012 for CVE-2026-7819",
"url": "https://bugzilla.suse.com/1265012"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-7819"
},
{
"cve": "CVE-2026-7820",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-7820"
}
],
"notes": [
{
"category": "general",
"text": "Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.\n\npgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security\u0027s default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin\u0027s User model relied on Flask-Security\u0027s UserMixin.is_locked() (which always returns \u0027not locked\u0027) and Flask-Login\u0027s is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS.\n\nFix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security\u0027s LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL).\n\nThis issue affects pgAdmin 4: before 9.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-7820",
"url": "https://www.suse.com/security/cve/CVE-2026-7820"
},
{
"category": "external",
"summary": "SUSE Bug 1265008 for CVE-2026-7820",
"url": "https://bugzilla.suse.com/1265008"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-desktop-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-doc-9.17-1.1.x86_64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.aarch64",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.s390x",
"openSUSE Tumbleweed:pgadmin4-web-uwsgi-9.17-1.1.x86_64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.aarch64",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.ppc64le",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.s390x",
"openSUSE Tumbleweed:system-user-pgadmin-9.17-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-13T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-7820"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…