CVE-2026-17566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17566", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-27T14:43:12.802Z", "datePublished": "2026-07-31T16:00:22.738Z", "dateUpdated": "2026-08-01T03:56:13.838Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-07-31T16:00:22.738Z"}, "title": "pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)", "affected": [{"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Import/Export Data"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py"], "versions": [{"status": "affected", "version": "0", "lessThan": "9.18", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "pgAdmin 4's Import/Export Data tool builds a psql \\copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \\copy tokenizer treats \\ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\\') TO PROGRAM 'echo pwned' x' was therefore accepted as \"balanced\" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \\copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor).\n\nThe fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \\ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing.\n\nThis issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18."}], "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/10213", "tags": ["issue-tracking"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Threat model: same as CVE-2025-12762/13780. An authenticated pgAdmin user (server mode) holding only the ordinary, routinely-granted \"Import/Export Data\" tool permission (tools_import_export_data) -- not an admin-only permission -- submits a single crafted POST to /import_export/job/<sid> with is_query_export true and a query field containing the payload. No further user interaction, no special server-side configuration, and no elevated pgAdmin role is required. Successful exploitation runs an arbitrary OS command as the pgAdmin application server's service account, which is a privilege escalation beyond anything the Import/Export Data permission is meant to grant (database-query access, not host command execution) -- Scope Changed. Impact is full compromise of the pgAdmin host (C/I/A: High)."}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Same reasoning as the CVSS 3.1 entry: network-reachable, low privilege required, no user interaction, host RCE compromises both pgAdmin's own authority (SC/SI/SA: High) and the underlying system data/integrity/availability (VC/VI/VA: High)."}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 9.4, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "cweId": "CWE-78", "type": "CWE"}, {"lang": "en", "description": "CWE-115 Misinterpretation of Input", "cweId": "CWE-115", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Arpit Jain (arpitjain099)", "type": "finder"}, {"lang": "en", "value": "Ashesh Vashi <ashesh.vashi@enterprisedb.com>", "type": "remediation developer"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-17566"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-01T03:56:13.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T16:58:55.142206Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T16:59:32.594Z"}}], "cna": {"title": "pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Arpit Jain (arpitjain099)"}, {"lang": "en", "type": "remediation developer", "value": "Ashesh Vashi <ashesh.vashi@enterprisedb.com>"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "Threat model: same as CVE-2025-12762/13780. An authenticated pgAdmin user (server mode) holding only the ordinary, routinely-granted \"Import/Export Data\" tool permission (tools_import_export_data) -- not an admin-only permission -- submits a single crafted POST to /import_export/job/<sid> with is_query_export true and a query field containing the payload. No further user interaction, no special server-side configuration, and no elevated pgAdmin role is required. Successful exploitation runs an arbitrary OS command as the pgAdmin application server's service account, which is a privilege escalation beyond anything the Import/Export Data permission is meant to grant (database-query access, not host command execution) -- Scope Changed. Impact is full compromise of the pgAdmin host (C/I/A: High)."}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}, "scenarios": [{"lang": "en", "value": "Same reasoning as the CVSS 3.1 entry: network-reachable, low privilege required, no user interaction, host RCE compromises both pgAdmin's own authority (SC/SI/SA: High) and the underlying system data/integrity/availability (VC/VI/VA: High)."}]}], "affected": [{"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Import/Export Data"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "0", "lessThan": "9.18", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/10213", "tags": ["issue-tracking"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "pgAdmin 4's Import/Export Data tool builds a psql \\copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \\copy tokenizer treats \\ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\\') TO PROGRAM 'echo pwned' x' was therefore accepted as \"balanced\" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \\copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor).\n\nThe fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \\ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing.\n\nThis issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-115", "description": "CWE-115 Misinterpretation of Input"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-07-31T16:00:22.738Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17566", "state": "PUBLISHED", "dateUpdated": "2026-08-01T03:56:13.838Z", "dateReserved": "2026-07-27T14:43:12.802Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-07-31T16:00:22.738Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Import/Export Data"], "product": "pgAdmin 4", "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py"], "repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "versions": [{"lessThan": "9.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*", "matchCriteriaId": "1294E54D-F1E1-406D-B2FD-B127521257DC", "versionEndExcluding": "9.18", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pgAdmin 4's Import/Export Data tool builds a psql \\copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \\copy tokenizer treats \\ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\\') TO PROGRAM 'echo pwned' x' was therefore accepted as \"balanced\" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \\copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor).\n\nThe fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \\ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing.\n\nThis issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18."}, {"lang": "es", "value": "La herramienta de Importaci\u00f3n/Exportaci\u00f3n de Datos de pgAdmin 4 construye una l\u00ednea de comando psql \\copy (...) interpolando una consulta SQL proporcionada por el usuario en una plantilla Jinja y pasando la l\u00ednea renderizada a psql a trav\u00e9s de --command. Para evitar que un atacante escape del envoltorio (...), create_import_export_job() (ruta POST /import_export/job/[sid], protegida solo por el permiso ordinario y com\u00fanmente otorgado tools_import_export_data) validaba la consulta con un verificador de balance de par\u00e9ntesis escrito a mano, _is_query_parens_balanced(). Ese verificador siempre trataba una barra invertida antes de una comilla simple (\\\u2019) como escape de la comilla, es decir, como si standard_conforming_strings estuviera desactivado. PostgreSQL ha establecido standard_conforming_strings en activado por defecto desde la versi\u00f3n 9.1 (2010), el valor por defecto en cada versi\u00f3n de PostgreSQL que pgAdmin 4 soporta actualmente (13-18); bajo ese valor por defecto, el propio tokenizador \\copy de psql trata \\ como un car\u00e1cter ordinario, por lo que una comilla simple inmediatamente despu\u00e9s cierra el literal de cadena. Una consulta como SELECT \u2019a\\\u2019) TO PROGRAM \u2019echo pwned\u2019 x\u2019 fue por lo tanto aceptada como \u201cbalanceada\u201d por el verificador de pgAdmin (que cre\u00eda que el ) todav\u00eda estaba dentro de la cadena), mientras que psql, ejecutado a trav\u00e9s de la l\u00ednea de comando renderizada real, cierra la cadena en ese punto y trata el siguiente ) como el final de la subconsulta \\copy (...) envolvente, exponiendo una cl\u00e1usula TO PROGRAM \u2019[command]\u2019 elegida por el atacante que psql ejecuta a trav\u00e9s de popen() -- independientemente de un error de sintaxis posterior m\u00e1s adelante en la misma l\u00ednea. Esta es la misma clase de error que CVE-2025-12762/CVE-2025-13780 (RCE a trav\u00e9s de inyecci\u00f3n de meta-comando psql/COPY durante la restauraci\u00f3n de volcado en formato PLAIN), alcanzado a trav\u00e9s de una defensa escrita independientemente en un m\u00f3dulo diferente (Importaci\u00f3n/Exportaci\u00f3n de Datos en lugar de Restauraci\u00f3n) que ten\u00eda su propio y diferente error l\u00f3gico (sem\u00e1ntica de escape de barra invertida invertida en lugar de un ancla de regex derrotada por BOM).\n\nLa soluci\u00f3n rechaza directamente cualquier barra invertida dentro de una cadena entre comillas simples en la consulta, en lugar de elegir una de las dos posibles interpretaciones de psql. Esto es intencionalmente conservador: porque la interpretaci\u00f3n correcta de \\ depende de la configuraci\u00f3n standard_conforming_strings del servidor de destino, que el verificador no puede conocer de forma fiable en el momento de la validaci\u00f3n, rechazar la consulta es m\u00e1s seguro que adivinar.\n\nEste problema afecta a pgAdmin 4: desde la introducci\u00f3n de _is_query_parens_balanced() antes de la versi\u00f3n 9.18."}], "id": "CVE-2026-17566", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17566", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-31T16:17:00.037", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Patch"], "url": "https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/pgadmin-org/pgadmin4/issues/10213"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-115"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "pgAdmin 4: pgAdmin 4: Remote Code Execution via backslash-escape mismatch in Import/Export Data tool", "id": "2509835", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509835"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in pgAdmin 4, a management tool for PostgreSQL databases. The Import/Export Data feature incorrectly processes certain user-provided SQL queries, specifically regarding how backslash characters are interpreted. This vulnerability allows an authenticated remote attacker, with specific permissions, to bypass security checks and execute unauthorized commands on the server running pgAdmin 4. Successful exploitation could lead to remote code execution, giving the attacker full control over the affected system."], "name": "CVE-2026-17566", "public_date": "2026-07-31T16:00:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-17566\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17566\nhttps://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3\nhttps://github.com/pgadmin-org/pgadmin4/issues/10213"], "statement": "This flaw does not affect Red Hat products, but only the Fedora community project.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.18)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "pgAdmin 4", "source": "cna", "vendor": "pgadmin.org"}, "product": "pgadmin_4", "vendor": "pgadmin"}], "created": "2026-08-02T04:15:04.184020+00:00", "updated": "2026-08-03T15:45:03.939878+00:00", "vendors": ["pgadmin", "pgadmin$PRODUCT$pgadmin_4"]}