CVE-2026-17347

{"id": "CVE-2026-17347", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17347", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "affectedData": [{"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Master Password Hook"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "7.2", "lessThan": "9.17", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/master_password.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/config.py"], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T16:16:59.140", "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/commit/e7a85767314e7b0fe0b35fe80b9c1af38f48dff6", "tags": ["Patch"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/ea7e798aac27174d2bacee1d6e136bed76a95e23", "tags": ["Patch"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgadmin-org/pgadmin4/issues/10191", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (';', '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u.\n\nFix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell.\n\nThis issue affects pgAdmin 4: from 7.2 before 9.17."}, {"lang": "es", "value": "La configuraci\u00f3n MASTER_PASSWORD_HOOK, introducida en pgAdmin 4 7.2, permite a un administrador configurar un comando externo que devuelve una clave de cifrado por usuario, con %u en la cadena configurada reemplazado por el nombre del usuario actual. La implementaci\u00f3n anterior sustitu\u00eda el nombre de usuario directamente en la cadena de comando y ejecutaba el resultado con subprocess.Popen(..., shell=True). Debido a que el nombre de usuario puede originarse de una fuente de autenticaci\u00f3n externa (declaraciones de OAuth/OIDC, Kerberos, autenticaci\u00f3n de servidor web) en lugar de un valor que pgAdmin controla completamente, un nombre de usuario que contiene metacaracteres de shell (\u2019;\u2019, \u2019$()\u2019, backticks, pipes, \u2019&&\u2019, newlines) permit\u00eda a un usuario autenticado ejecutar comandos arbitrarios como la cuenta de servicio de pgAdmin en cualquier despliegue donde la cadena de hook configurada usa %u.\n\nLa correcci\u00f3n tokeniza primero la cadena de hook confiable y configurada por el administrador en un vector de argumentos (usando shlex en modo de citaci\u00f3n POSIX, con el escape de barra invertida deshabilitado para que las rutas de estilo Windows no se interpreten incorrectamente), sustituye el nombre de usuario no confiable en los elementos individuales de argv, y ejecuta con shell=False. Por lo tanto, el nombre de usuario siempre est\u00e1 confinado a un \u00fanico elemento de argv; cualquier metacaracter de shell que contenga es inerte. Los administradores cuyo MASTER_PASSWORD_HOOK depend\u00eda anteriormente de caracter\u00edsticas de shell (pipes, redirecci\u00f3n, expansi\u00f3n de variables de entorno, globbing) dentro de la propia cadena de hook deben mover esa l\u00f3gica al script invocado, ya que ya no es interpretado por un shell.\n\nEste problema afecta a pgAdmin 4: desde 7.2 antes de 9.17."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*", "vulnerable": true, "matchCriteriaId": "D195F137-FD9F-41D7-9B29-AAE673996F92", "versionEndExcluding": "9.17", "versionStartIncluding": "7.2"}], "operator": "OR"}]}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}