CVE-2026-17566: pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQ

This month

CRITICAL 9.9UPGRADE

CVE-2026-17566 is a critical-severity flaw (CVSS 9.9) affecting pgadmin 4. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesi

Why this priority

Critical severity

A fixed release or distro patch exists.

Risk facts

CVSS score	9.9 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.7% (top 48%)
CISA exploited list	No
Weakness	CWE-78, CWE-115
Published	2026-07-31
Last modified	2026-10-23

Publisher (CNA): PostgreSQL · Vendor: pgadmin

Am I affected?

Timeline

2026-07-31 16:17 UTCPublished CVE record published
2026-10-23 23:10 UTCUpdated Record last modified

pgadmin pgadmin 4 UPGRADE

Affected: < 9.18

Fixed in: 9.18

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy pgadmin-4 || rpm -q pgadmin-4 || pgadmin-4 --version

2. UPGRADE to 9.18 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade pgadmin-4

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade pgadmin-4

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · python-fontconfig · FIXED · 0.6.3-1.fc46 · FEDORA-2026-f92ca8b01f · source

sudo dnf upgrade --advisory=FEDORA-2026-f92ca8b01f

Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source

sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: HackSpeak/CVE-2026-17566 (2 stars)

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

CVE-2026-17346 HIGH 8.8 UPGRADE The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple
CVE-2026-17349 CRITICAL 9.6 UPGRADE /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed
CVE-2026-17351 CRITICAL 9.0 UPGRADE The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's exec
CVE-2026-17347 HIGH 7.5 UPGRADE The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external com
CVE-2026-17348 MEDIUM 6.5 UPGRADE In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the applica

References

← Back to latest CVEs