pgAdmin 4 9.11 for PostgreSQL
Approved changes feed: RSS · Atom
cpe:2.3:a:pgadmin:pgadmin_4:9.11:*:*:*:*:postgresql:*:*
part: a version: 9.11 update: *
| Vendor | Pgadmin (7b0eac40-34ec-5c7c-ab30-f64b5bcb1271) |
|---|---|
| Product | Pgadmin 4 (58509cef-5fbc-593a-aaa3-5d23db7954e4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | postgresql |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/dpage/pgadmin4 |
purl2cpe | 2026-07-28 16:41:05.467699 |
pkg:github/pgadmin-org/pgadmin4 |
purl2cpe | 2026-07-28 16:41:05.467701 |
pkg:pypi/pgadmin4 |
purl2cpe | 2026-07-28 16:41:05.467703 |
pkg:rpm/fedora/pgadmin4 |
purl2cpe | 2026-07-28 16:41:05.467705 |
pkg:rpm/opensuse/pgadmin4 |
purl2cpe | 2026-07-28 16:41:05.467706 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1707 |
vulnerable | 2026-06-08 07:49:09.408858 |
Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)
HIGH (7.4)
pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.
Published: 2026-02-05T17:30:05.089Z
Updated: 2026-02-26T21:50:19.579Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.