CVE-2026-1707: pgAdmin4 Restore Restriction Bypass via Key Disclosure Vulnerability
Summary
CVE-2026-1707: pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability. Affects pgadmin4 versions < 9.12. Fixed in 9.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, allowing users to manage database objects, execute SQL queries, and perform database backups and restores. The software is widely used for its user-friendly web interface and robust features. However, versions prior to 9.12 are vulnerable to a key disclosure issue that can lead to unauthorized command execution during restore operations.
Vulnerability Detail
The vulnerability arises in pgAdmin versions 9.11 when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation and extract the '\restrict' key in real time. By racing the restore process, the attacker can overwrite the restore script with a payload that re-enables meta-commands using '\unrestrict <key>'. This allows for reliable command execution on the pgAdmin host during the restore operation, potentially compromising the integrity and security of the database.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.12
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the pgAdmin web interface to trusted users only, and avoid performing restores from PLAIN-format dump files until the package is updated.
Conclusion
In summary, CVE-2026-1707 is a significant vulnerability in pgAdmin4 that allows for a restore restriction bypass via key disclosure. Users are strongly advised to update to version 9.12 or later to mitigate this risk. Until then, implementing access restrictions and avoiding certain restore methods can help protect against potential exploitation.
See every vulnerability recorded for pgadmin4 →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
pgAdmin versions prior to 9.12 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update immediately, restrict access to the pgAdmin web interface and avoid using PLAIN-format dump files for restores.
More information can be found in the advisory published on GitHub at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-3p7x-94q9-jq9x/GHSA-3p7x-94q9-jq9x.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
