CVE-2026-7818: pgAdmin 4 Deserialization Flaw Allows RCE

The National Vulnerability Database has detailed CVE-2026-7818, a high-severity deserialization vulnerability (CWE-502) in pgAdmin 4’s FileBackedSessionManager. This flaw allowed unsafe deserialization of session file contents, leveraging Python’s standard object-serialization module, before any HMAC integrity check. Essentially, any file dropped into the sessions directory was unconditionally deserialized.

An authenticated user with write access to the sessions directory—either through misconfiguration or in conjunction with another path traversal vulnerability—could plant a specially crafted serialized payload. This would lead to operating-system level remote code execution under the pgAdmin process identity. The National Vulnerability Database states this issue affects pgAdmin 4 versions prior to 9.15.

The fix involves prepending a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifying it via hmac.compare_digest before any deserialization. This critical integrity check is now enforced, even raising an error if SECRET_KEY is empty, preventing attackers from bypassing it. This is a classic example of what happens when integrity checks come too late in the processing chain.