CVE-2026-17348

{"id": "CVE-2026-17348", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17348", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T17:22:27.726914Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "affectedData": [{"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Constraints", "Debugger"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "1.0", "lessThan": "9.17", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/constraints/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/debugger/__init__.py"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Schema Diff"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "4.18", "lessThan": "9.17", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/schema_diff/__init__.py"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Preferences"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "8.2", "lessThan": "9.17", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/preferences/__init__.py"], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T16:16:59.287", "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05", "tags": ["Patch"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgadmin-org/pgadmin4/issues/10194", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).\n\nA follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.\n\nFix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.\n\nThis issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17."}, {"lang": "es", "value": "En modo SERVIDOR, pgAdmin 4 impone la autenticaci\u00f3n por ruta a trav\u00e9s del decorador @pga_login_required; el \u2019hook\u2019 before_request de la aplicaci\u00f3n solo maneja el inicio de sesi\u00f3n autom\u00e1tico en modo escritorio y la redirecci\u00f3n de autenticaci\u00f3n Kerberos/servidor web, por lo que cualquier ruta enviada sin el decorador es accesible sin autenticaci\u00f3n (CWE-306). Esta es la misma clase de defecto previamente corregida como CVE-2026-12046 (las rutas sqleditor close/update_connection).\n\nUn barrido de seguimiento, impulsado por un informe que describ\u00eda una correcci\u00f3n incompleta para CVE-2026-12046, encontr\u00f3 m\u00e1s rutas a las que les faltaba @pga_login_required: las rutas \u2019nodes\u2019 y \u2019proplist\u2019 (listado de objetos) del \u2019blueprint\u2019 de Constraints y su ruta \u2019delete\u2019 (un DELETE que muta el estado y elimina restricciones de tabla); preferences.get_all_cli (GET, revela todos los valores de preferencias configurables por CLI); debugger.close (DELETE); y schema_diff.close (DELETE). Un cliente de red no autenticado podr\u00eda, por lo tanto, enumerar metadatos de restricciones, eliminar restricciones de tabla, leer valores de preferencias y forzar el cierre de sesiones de depurador o de \u2019schema-diff\u2019 pertenecientes a otros usuarios, sin autenticarse nunca.\n\nLa correcci\u00f3n a\u00f1ade el decorador @pga_login_required faltante (y la importaci\u00f3n correspondiente al m\u00f3dulo Constraints) a cada una de estas rutas. El cambio es solo de decorador; sin cambios de comportamiento en los manejadores subyacentes.\n\nEste problema afecta a pgAdmin 4 en modo SERVIDOR: las rutas Constraints y Debugger desde 1.0, la ruta Schema Diff close desde 4.18, y preferences.get_all_cli desde 8.2, todo antes de 9.17."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*", "vulnerable": true, "matchCriteriaId": "0D8663EF-5416-45B4-9B8D-1F40E3DBC1F7", "versionEndExcluding": "9.17", "versionStartIncluding": "1.0"}], "operator": "OR"}]}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}