CVE-2026-86864

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

EUVD-2026-81694

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86862

pgAdmin 4 's Restore and Maintenance tools were vulnerable to connection-string injection through the database field, passed directly as --dbname to pg_restore/psql. Because libpq expands a database name containing = into a full connection string, an attacker-supplied value like host=attacker.exa...

CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...