CVE-2026-17349

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.0 through 9.16

Description The /misc/workspace/adhoc connect server endpoint, part of the Workspaces feature, improperly clones server records using the Server.clone() function. When a non-owner triggers an adhoc connection to another user's shared server, the system copies all columns from the source row, including user id, shared, shared username, and credential fields such as password, save password, and tunnel password. This allows a non-owner to inherit the ownership and stored database credentials of the source user, typically an administrator. Because the record is persisted before the connection attempt, the non-owner can subsequently use the cloned server to connect to the database using the source user's privileges.

Recommendations Update pgAdmin 4 to version 9.17 or later.