CVE-2026-1707 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2026-1707 Interim 1 1 2026-03-05T00:19:28Z current 2026-03-05T00:19:28Z 2026-03-05T00:19:28Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2026-1707 pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP7 openSUSE Leap 15.6 pgadmin4 pgadmin4-cloud pgadmin4-desktop pgadmin4-doc pgadmin4-web pgadmin4-web-uwsgi system-user-pgadmin pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4 as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4-doc as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4-web as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 system-user-pgadmin as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP6-LTSS system-user-pgadmin as a component of SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server Teradata 15 SP4 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 system-user-pgadmin as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4 as a component of openSUSE Leap 15.6 pgadmin4-cloud as a component of openSUSE Leap 15.6 pgadmin4-desktop as a component of openSUSE Leap 15.6 pgadmin4-doc as a component of openSUSE Leap 15.6 pgadmin4-web-uwsgi as a component of openSUSE Leap 15.6 system-user-pgadmin as a component of openSUSE Leap 15.6 pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation. CVE-2026-1707 important 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L