Detections
Analytics

SCA: security update for pgadmin4 (GHSA-p58c-q354-6c4f)

high Tenable Cloud Security Plugin ID 442084

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API
 configuration endpoints. User-supplied api_key_file and api_url preferences were passed to the LLM
 provider clients without validation. An authenticated user could read arbitrary server-side files by
 pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests
 to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting
 the chat path and model-list endpoints. Fix restricts api_key_file to the user's private storage (server
 mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and
 gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point. This
 issue affects pgAdmin 4: before 9.15. (CVE-2026-7817)

Solution

Update the pgadmin4 library and its related packages to version 9.15 or later.

See Also

https://github.com/advisories/GHSA-p58c-q354-6c4f

Plugin Details

Severity: High

ID: 442084

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 5/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.69

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-7817

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/11/2026

Vulnerability Publication Date: 5/11/2026

Reference Information

CVE: CVE-2026-7817

cwe: CWE-552