CVE-2026-91924: pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgwebto a version that resolves this vulnerability.Fixed in 0.17.0 - Configuration
Ensure the POST /api/connect endpoint is properly guarded so connect-backend authorization prevents attackers from supplying arbitrary database connection strings.
pgweb POST /api/connect endpoint authorization guard = enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
pgweb versions through 0.17.0 are affected when connect-backend authorization is configured. The provided information does not establish whether deployments without that configuration are affected.
What does an attacker need to exploit this issue?
The CVSS vector indicates network access, low attack complexity, no user interaction, and low privileges required. The attacker supplies a custom session identifier and a database connection URL to the direct-connect endpoint.
What access can exploitation provide?
An attacker can bypass the intended resource-to-database mapping and use arbitrary database connection strings. This may enable access to unauthorized databases and internal services reachable through those connection targets.