CVE-2026-7818

Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity. Fix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O. This issue affects pgAdmin 4: before 9.15.

• CWE-502

• https://github.com/pgadmin-org/pgadmin4/issues/9901Issue Tracking, Patch, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78172The Themify – WooCommerce Product Filter plugin for WordPres…6.1
• CVE-2026-78174WatchGuard Dimension records unredacted session identifiers …9.3
• CVE-2026-78175The Tutor LMS – eLearning and online course solution plugin …8.8
• CVE-2026-78177A vulnerability was found in TanStack devtools-vite 0.7.0. A…4.5
• CVE-2026-78178A vulnerability was determined in jQWidgets up to 24.0.1. Th…7.3
• CVE-2026-78179A vulnerability was identified in rexrainbow phaser3-rex-not…6.3
• CVE-2026-78180A security flaw has been discovered in alibaba-fusion next u…7.3
• CVE-2026-78181A weakness has been identified in ractivejs ractive up to 1.…7.3
• CVE-2026-78182A security vulnerability has been detected in Shenzhen Gongj…7.3
• CVE-2026-78183DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds wri…9.8
• CVE-2026-78185A vulnerability was detected in itsourcecode Sales and Inven…6.3
• CVE-2026-78186A flaw has been found in Open5GS up to 2.8.0. This affects a…4.3