CVE-2026-7818: pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution
Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.
The session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.
Fix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRETKEY, and verifies it via hmac.comparedigest before any deserialization. The check is raised (rather than asserted) on empty SECRETKEY so it is not stripped under -O.
This issue affects pgAdmin 4: before 9.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgAdmin 4 FileBackedSessionManagerto a version that resolves this vulnerability.Fixed in 9.15 - Configuration
Configure pgAdmin so SECRET_KEY is not empty; this preserves the raised check that prevents unsafe deserialization from running when SECRET_KEY is invalid.
pgAdmin 4 FileBackedSessionManager SECRET_KEY integrity check behavior = Set SECRET_KEY to a non-empty value so the raised (not asserted) HMAC verification is enforced before any deserialization - Compensating control
Ensure an authenticated user cannot write to the pgAdmin sessions directory (e.g., correct permissions so only the pgAdmin process can write there).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7818?
The severity of CVE-2026-7818 is classified as high with a score of 7.3.
How do I fix CVE-2026-7818?
To fix CVE-2026-7818, you should apply the available patch for pgAdmin 4.
What kind of vulnerability is CVE-2026-7818?
CVE-2026-7818 is a vulnerability related to unsafe deserialization, specifically CWE-502.
What can be exploited through CVE-2026-7818?
CVE-2026-7818 can be exploited to achieve remote code execution.
Which component of pgAdmin 4 is affected by CVE-2026-7818?
The affected component in pgAdmin 4 is the FileBackedSessionManager.