The vulnerability in pgAdmin 4 arises from unvalidated user‑supplied settings for LLM API configuration. The supplied api_key_file and api_url preferences are forwarded directly to LLM provider clients, allowing an authenticated user to read any file accessible to the pgAdmin process (local file inclusion) or to force pgAdmin to open internal network connections such as the cloud metadata service (server‑side request forgery). This flaw exposes confidential server files and the ability to reach internal services without external network access.

pgAdmin 4 released by pgadmin.org, any installation using a version prior to 9.15, where the LLM API configuration endpoints accept unvalidated api_key_file and api_url preferences.

The CVSS base score is 7.1, indicating medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, so no publicly documented active exploits exist. However, because the flaw requires authentication, an attacker who gains user access can read arbitrary files and send internal network requests, compromising confidentiality and potentially affecting the availability of internal services. The absence of known exploits reduces immediate threat but the flaw remains inherently exploitable in permissive environments.