CVE-2026-17348: pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/updateconnection routes).
A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pgaloginrequired: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.getallcli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schemadiff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.
Fix adds the missing @pgaloginrequired decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.
This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.getallcli from 8.2, all before 9.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgAdmin 4to a version that resolves this vulnerability.Fixed in 9.17 - Configuration
In pgAdmin 4 SERVER mode, add the @pga_login_required decorator (and the corresponding import to the Constraints module) to the Constraints blueprint's nodes, proplist (object listing) routes, and its state-mutating DELETE route that removes table constraints.
pgAdmin 4 Constraints blueprint routes (nodes/proplist/object-listing routes and delete route) @pga_login_required decorator = added - Configuration
Add the @pga_login_required decorator to preferences.get_all_cli (GET route disclosing all CLI-settable preference values) in SERVER mode.
pgAdmin 4 preferences.get_all_cli route @pga_login_required decorator = added - Configuration
Add the @pga_login_required decorator to debugger.close (DELETE route that force-closes debugger sessions) in SERVER mode.
pgAdmin 4 debugger.close route @pga_login_required decorator = added - Configuration
Add the @pga_login_required decorator to schema_diff.close (DELETE route that force-closes schema-diff sessions) in SERVER mode.
pgAdmin 4 schema_diff.close route @pga_login_required decorator = added
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17348?
The severity of CVE-2026-17348 is medium with a score of 6.5.
How do I fix CVE-2026-17348?
To fix CVE-2026-17348, ensure that all routes in pgAdmin 4 that require authentication are decorated with the @pga_login_required decorator.
What components are affected by CVE-2026-17348?
CVE-2026-17348 affects the Constraints, preferences, Debugger, and Schema Diff routes in pgAdmin 4 when operating in SERVER mode.
What does CVE-2026-17348 allow an attacker to do?
CVE-2026-17348 allows unauthenticated access to certain routes in pgAdmin 4 when not properly secured with the authentication decorator.
Is CVE-2026-17348 a new vulnerability?
CVE-2026-17348 is related to an incomplete fix for CVE-2026-12046, highlighting ongoing issues with authentication in pgAdmin 4.