THREAT OPS › Threat News › [NVD] CVE-2026-17347 (HIGH 7.5) — The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username di
[NVD] CVE-2026-17347 (HIGH 7.5) — The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username di
CVE-2026-17347 CVSS: 7.5 HIGH Published: 2026-07-31T16:16:59.140
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result
Indicators of compromise
- CVE-2026-17347cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-17347