CVE-2026-17347: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pgadmin.org pgAdmin 4
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (';', '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u. Fix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell. This issue affects pgAdmin 4: from 7.2 before 9.17.
AI Analysis
Technical Summary
The vulnerability in pgAdmin 4 versions >=7.2 and <9.17 involves improper neutralization of special elements in an OS command (CWE-78). The MASTER_PASSWORD_HOOK setting executes an external command with the username substituted directly into the command string using subprocess.Popen with shell=True. Because usernames can originate from external authentication sources and may include shell metacharacters, this allowed authenticated users to execute arbitrary commands with the privileges of the pgAdmin service account. The fix changes the execution to use shlex tokenization and subprocess.Popen with shell=False, confining the username to a single argument and neutralizing shell metacharacters. Administrators relying on shell features in the hook string must adapt their scripts accordingly.
Potential Impact
An authenticated user can exploit this vulnerability to execute arbitrary OS commands with the privileges of the pgAdmin service account. This can lead to complete compromise of the pgAdmin environment, including confidentiality, integrity, and availability impacts. The vulnerability is rated with a CVSS 3.1 score of 7.5 (high severity), indicating significant potential impact if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by changing the command execution method to use argument vector tokenization and shell=False, preventing shell metacharacters in usernames from being interpreted. Administrators should upgrade to pgAdmin 4 version 9.17 or later when available. Until then, avoid using untrusted usernames in shell commands or modify the MASTER_PASSWORD_HOOK to not rely on shell features. Review and adapt any hook scripts that depend on shell-specific behavior to run correctly under the new execution method.
CVE-2026-17347: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pgadmin.org pgAdmin 4
Description
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (';', '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u. Fix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell. This issue affects pgAdmin 4: from 7.2 before 9.17.
CVSS v3.1
Score 7.5high
Affected software
pgadmin.org
pgAdmin 4
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in pgAdmin 4 versions >=7.2 and <9.17 involves improper neutralization of special elements in an OS command (CWE-78). The MASTER_PASSWORD_HOOK setting executes an external command with the username substituted directly into the command string using subprocess.Popen with shell=True. Because usernames can originate from external authentication sources and may include shell metacharacters, this allowed authenticated users to execute arbitrary commands with the privileges of the pgAdmin service account. The fix changes the execution to use shlex tokenization and subprocess.Popen with shell=False, confining the username to a single argument and neutralizing shell metacharacters. Administrators relying on shell features in the hook string must adapt their scripts accordingly.
Potential Impact
An authenticated user can exploit this vulnerability to execute arbitrary OS commands with the privileges of the pgAdmin service account. This can lead to complete compromise of the pgAdmin environment, including confidentiality, integrity, and availability impacts. The vulnerability is rated with a CVSS 3.1 score of 7.5 (high severity), indicating significant potential impact if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by changing the command execution method to use argument vector tokenization and shell=False, preventing shell metacharacters in usernames from being interpreted. Administrators should upgrade to pgAdmin 4 version 9.17 or later when available. Until then, avoid using untrusted usernames in shell commands or modify the MASTER_PASSWORD_HOOK to not rely on shell features. Review and adapt any hook scripts that depend on shell-specific behavior to run correctly under the new execution method.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-07-25T02:52:54.844Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6cf74dbf32cb7a34294b0a
Added to database: 07/31/2026, 19:28:13 UTC
Last enriched: 07/31/2026, 19:39:46 UTC
Last updated: 09/14/2026, 10:01:29 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.