SEPTEMBER 16, 2026
Live Feed
Back to database
Case File

CVE-2026-91924

HIGH · CVSS 8.5 EPSS 0.25% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-16

CyberRota Analysis

AI-Generated

The vulnerability in pgweb versions up to 0.17.0 exposes the POST /api/connect endpoint, allowing attackers to submit arbitrary database connection strings when connect-backend authorization is configured. This flaw enables unauthorized access to databases and internal services by bypassing resource-to-database mappings through custom session identifiers. Organizations using affected versions should prioritize remediation to prevent potential data breaches and unauthorized access to sensitive information.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-91924
Severity
HIGH
CVSS
8.5
EPSS
0.25%

Original NVD Description

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.