https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:08:22 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09272 bdu:2026-09272 https://cve.radiocsirt.org/vuln/bdu:2026-09272 https://cve.radiocsirt.org/vuln/euvd-2026-329155 EUVD-2026-329155 https://cve.radiocsirt.org/vuln/euvd-2026-329155 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12046 <p>Two state-mutating endpoints in pgAdmin 4&#39;s SQL Editor blueprint -- DELETE /sqleditor/close/&lt;trans_id&gt; and POST /sqleditor/initialize/sqleditor/update_connection/&lt;sgid&gt;/&lt;sid&gt;/&lt;did&gt; -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session[&#39;gridData&#39;][&lt;trans_id&gt;][&#39;command_obj&#39;]: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.</p> <p>The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin&#39;s Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin&#39;s sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.</p> <p>Fix is a one-line @pga_login_required dec…</p> <p>Two state-mutating endpoints in pgAdmin 4&#39;s SQL Editor blueprint -- DELETE /sqleditor/close/&lt;trans_id&gt; and POST /sqleditor/initialize/sqleditor/update_connection/&lt;sgid&gt;/&lt;sid&gt;/&lt;did&gt; -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session[&#39;gridData&#39;][&lt;trans_id&gt;][&#39;command_obj&#39;]: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.</p> <p>The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin&#39;s Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin&#39;s sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.</p> <p>Fix is a one-line @pga_login_required dec…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12046 https://cve.radiocsirt.org/vuln/ghsa-mmqg-h4qx-g8qv <p>Two state-mutating endpoints in pgAdmin 4&#39;s SQL Editor blueprint -- DELETE /sqleditor/close/&lt;trans_id&gt; and POST /sqleditor/initialize/sqleditor/update_connection/&lt;sgid&gt;/&lt;sid&gt;/&lt;did&gt; -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session[&#39;gridData&#39;][&lt;trans_id&gt;][&#39;command_obj&#39;]: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.</p> <p>The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin&#39;s Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin&#39;s sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.</p> <p>Fix is a one-line @pga_login_required dec…</p> <p>Two state-mutating endpoints in pgAdmin 4&#39;s SQL Editor blueprint -- DELETE /sqleditor/close/&lt;trans_id&gt; and POST /sqleditor/initialize/sqleditor/update_connection/&lt;sgid&gt;/&lt;sid&gt;/&lt;did&gt; -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session[&#39;gridData&#39;][&lt;trans_id&gt;][&#39;command_obj&#39;]: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.</p> <p>The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin&#39;s Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin&#39;s sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.</p> <p>Fix is a one-line @pga_login_required dec…</p> https://cve.radiocsirt.org/vuln/ghsa-mmqg-h4qx-g8qv https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 <p>pgadmin4-9.17-1.1 on GA media</p> <p>pgadmin4-9.17-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005