Summary
In pgAdmin 4 server mode, SSH tunnel creation may unintentionally use the operating-system service account's private keys, SSH configuration, or agent instead of only credentials supplied by the user. An authenticated pgAdmin user could therefore reach hosts that trust the service account, potentially without possessing valid credentials of their own.
In pgAdmin 4 server mode, SSH tunnel creation may unintentionally use the operating-system service account's private keys, SSH configuration, or agent instead of only credentials supplied by the user. An authenticated pgAdmin user could therefore reach hosts that trust the service account, potentially without possessing valid credentials of their own.
Affected context
The issue occurs in pgAdmin 4 server-mode SSH tunnel handling when the sshtunnel library is allowed to consult the service account's default ~/.ssh directory, SSH configuration, or agent. Deployments are particularly exposed when that account has private keys, trusted host relationships, or agent access that are broader than the permissions intended for individual pgAdmin users. Desktop mode is not affected according to the advisory.
The issue occurs in pgAdmin 4 server-mode SSH tunnel handling when the sshtunnel library is allowed to consult the service account's default ~/.ssh directory, SSH configuration, or agent. Deployments are particularly exposed when that account has private keys, trusted host relationships, or agent access that are broader than the permissions intended for individual pgAdmin users. Desktop mode is not affected according to the advisory.
Exploit preconditions
- Attack surface: pgAdmin server-mode SSH tunnel configuration
- Required access: An authenticated pgAdmin user who can create or configure a tunnel
- Trigger point: Establishment of an SSH tunnel to a selected host
- Why exploitation is possible: Missing restrictions allow the tunnel library to discover and use credentials, SSH settings, or an agent belonging to the operating-system service account rather than limiting authentication to the user's configured credentials
- Attack surface: pgAdmin server-mode SSH tunnel configuration
- Required access: An authenticated pgAdmin user who can create or configure a tunnel
- Trigger point: Establishment of an SSH tunnel to a selected host
- Why exploitation is possible: Missing restrictions allow the tunnel library to discover and use credentials, SSH settings, or an agent belonging to the operating-system service account rather than limiting authentication to the user's configured credentials
Why this happens
The underlying bug is an insecure credential and configuration trust boundary. pgAdmin invoked SSH tunneling without explicitly restricting private-key directories or the SSH configuration file, so default operating-system credential sources were implicitly consulted. This behavior maps primarily to CWE-522, where authentication credentials are not sufficiently protected from unintended use, and is also related to CWE-1188 because initialization and default resolution behavior exposed security-sensitive account state.
The underlying bug is an insecure credential and configuration trust boundary. pgAdmin invoked SSH tunneling without explicitly restricting private-key directories or the SSH configuration file, so default operating-system credential sources were implicitly consulted. This behavior maps primarily to CWE-522, where authentication credentials are not sufficiently protected from unintended use, and is also related to CWE-1188 because initialization and default resolution behavior exposed security-sensitive account state.
Potential impact
- An attacker could establish SSH connections using keys owned by the pgAdmin service account.
- The attacker may access hosts that trust the service account's credentials.
- Compromised destinations could enable lateral movement or further unauthorized access.
- SSH configuration options such as ProxyCommand could redirect or alter tunnel behavior.
- Sensitive data reachable by the service account could be exposed or modified.
- An attacker could establish SSH connections using keys owned by the pgAdmin service account.
- The attacker may access hosts that trust the service account's credentials.
- Compromised destinations could enable lateral movement or further unauthorized access.
- SSH configuration options such as ProxyCommand could redirect or alter tunnel behavior.
- Sensitive data reachable by the service account could be exposed or modified.
General mitigation guidance
Mitigation focuses on enforcing an explicit credential boundary for server-mode
tunnels:
- Use only the identity file or password deliberately configured by the user.
- Do not fall back to the operating-system account's ~/.ssh directory, SSH configuration, or agent.
- Treat missing or inaccessible user-selected identity files as configuration errors rather than searching default credential locations.
- Run the service account with least privilege and avoid placing broadly trusted private keys or agent access in its environment.
- Apply restrictive filesystem and secret-storage permissions to SSH credentials.
- Keep desktop and server authentication paths separately reviewed so their trust assumptions remain explicit.
Mitigation focuses on enforcing an explicit credential boundary for server-mode
tunnels:
- Use only the identity file or password deliberately configured by the user.
- Do not fall back to the operating-system account's ~/.ssh directory, SSH configuration, or agent.
- Treat missing or inaccessible user-selected identity files as configuration errors rather than searching default credential locations.
- Run the service account with least privilege and avoid placing broadly trusted private keys or agent access in its environment.
- Apply restrictive filesystem and secret-storage permissions to SSH credentials.
- Keep desktop and server authentication paths separately reviewed so their trust assumptions remain explicit.
How teams detect issues like this
Organizations can look for:
- Code paths that instantiate SSH clients without disabling default identity discovery or agent forwarding.
- Calls that omit explicit key-directory or SSH-configuration restrictions.
- Fallback logic that searches ~/.ssh when a user-supplied identity file is absent.
- Server-side tunnel features that inherit environment variables, home directories, or agent sockets from privileged service accounts.
- Runtime logs showing tunnel connections authenticated with service-account keys rather than user-selected credentials.
- Policy and static-analysis checks requiring explicit credential sources for automated SSH connections.
Organizations can look for:
- Code paths that instantiate SSH clients without disabling default identity discovery or agent forwarding.
- Calls that omit explicit key-directory or SSH-configuration restrictions.
- Fallback logic that searches ~/.ssh when a user-supplied identity file is absent.
- Server-side tunnel features that inherit environment variables, home directories, or agent sockets from privileged service accounts.
- Runtime logs showing tunnel connections authenticated with service-account keys rather than user-selected credentials.
- Policy and static-analysis checks requiring explicit credential sources for automated SSH connections.
