Is CVE-2026-91924 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-91924?

CVE-2026-91924 has a CVSS v3 severity of HIGH (8.5).

Back

CVE-2026-91924

Description

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.