high7.4
CVE-2026-1707
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
Impact
pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pgadmin4 | < 9.12 | 9.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pgadmin | Pgadmin 4 | Version 9.11 |