THREAT OPS › Threat News › [NVD] CVE-2026-17349 (CRITICAL 9.6) — /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the st
[NVD] CVE-2026-17349 (CRITICAL 9.6) — /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the st
CVE-2026-17349 CVSS: 9.6 CRITICAL Published: 2026-07-31T16:16:59.480
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, an
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-17349cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-17349