Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91924pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
High 8.5
In plain English
A high-severity missing authorization in pgweb from sosedoff. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.4%top 63.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
References
- GitHub Issue #869 issue-tracking
- https://github.com/sosedoff/pgweb product
- routes.go - /api/connect registered unconditionally alongside the backend-gated route technical-description
- api.go - Connect falls through to ConnectWithURL with no connect-backend check technical-description
- VulnCheck Advisory: pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint third-party-advisory