CVE-2026-17347

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 7.2 through 9.16

Description An issue exists in the MASTER PASSWORD HOOK setting where the application substitutes the username directly into a command string and executes it using subprocess.Popen(..., shell=True). Since usernames can originate from external authentication sources like OAuth/OIDC claims, Kerberos, or webserver auth, an authenticated user with a username containing shell metacharacters (such as ;, $(), backticks, pipes, &&, or newlines) can execute arbitrary commands as the pgAdmin service account.

Recommendations Update pgAdmin 4 to version 9.17 or later. For administrators who used shell features like pipes, redirection, environment-variable expansion, or globbing within the MASTER PASSWORD HOOK string, move that logic into the invoked script.