pgAdmin scores a 9.9 again, FreeRDP clipboard overflow hits 9.6, and Ansible EDA auth is a joke

When gnome-remote-desktop runs in system mode with RDP enabled on RHEL, the connection handler skips the throttler. An unauthenticated attacker can flood the RDP listener with parallel pre-auth connections, exhausting resources and locking out legitimate users. This is a denial-of-service bug, not code execution, and it only affects the Red Hat-shipped version, not upstream.

Affected estate

RHEL sysadmins running gnome-remote-desktop in system mode with RDP enabled

How to check

Run 'rpm -q gnome-remote-desktop' to check the installed version. Confirm if the daemon is in system mode with 'systemctl status gnome-remote-desktop' and verify RDP is enabled in the configuration.

Included because

unauthenticated; network-exploitable; denial of service; CVSS 7.5

Action

Apply the updated gnome-remote-desktop package from Red Hat and restrict RDP listener access via firewall rules.

Why it matters

An attacker can deny RDP access to all legitimate users by flooding pre-auth connections, which is disruptive if RDP is your primary remote access method.

Source

Red Hat advisory

A malicious or compromised RDP server can exploit a heap buffer overflow in FreeRDP's Windows clipboard handling. When a user pastes file content offered by the server, FreeRDP copies the server's response using the server-supplied size instead of the caller's buffer size. That lets the server write attacker-controlled data past the buffer boundary. This requires user interaction: the victim must paste clipboard content from the RDP session.

Affected estate

Anyone using FreeRDP 3.29.0 or earlier on Windows to connect to RDP servers, especially if connecting to untrusted or third-party servers

How to check

Run 'xfreerdp --version' or check the FreeRDP binary version. Any version at or below 3.29.0 is vulnerable.

Included because

heap overflow; attacker-controlled write; CVSS 9.6; requires user paste interaction but trivially social-engineered

Action

Upgrade FreeRDP to version 3.30.0 or later.

Why it matters

A rogue RDP server can get heap-level code execution on the client machine when a user pastes clipboard file content, with a CVSS of 9.6.

Source

FreeRDP project advisory

pgAdmin 4 versions 7.2 through 9.16 pass the current username directly into a shell command when the MASTER_PASSWORD_HOOK setting includes %u. Because usernames can come from external auth sources like OAuth, OIDC, or Kerberos, an attacker who controls their own username can embed shell metacharacters and run arbitrary commands as the pgAdmin service account. You're only vulnerable if MASTER_PASSWORD_HOOK is configured and uses %u, but if it is, any authenticated user can own your pgAdmin server.

Affected estate

Anyone running pgAdmin 4 versions 7.2 through 9.16 with the MASTER_PASSWORD_HOOK setting configured to use %u, especially with external authentication (OAuth, OIDC, Kerberos, webserver auth)

How to check

Check your pgAdmin configuration file (config_local.py or config_system.py) for a MASTER_PASSWORD_HOOK entry containing %u. Verify the installed pgAdmin version in the About dialog or with 'pip show pgadmin4'.

Included because

authenticated RCE; shell injection via external auth source; common admin tool; CVSS 7.5

Action

Upgrade to pgAdmin 4 version 9.17 or later. Review and update any MASTER_PASSWORD_HOOK scripts that relied on shell features like pipes or redirection, since the fix runs with shell=False.

Why it matters

An authenticated user with a crafted username from an external auth source can execute arbitrary OS commands as the pgAdmin service account.

Source

pgAdmin project advisory

pgAdmin 4's Import/Export Data tool lets an authenticated user with the commonly granted tools_import_export_data permission inject arbitrary commands via psql's \copy ... TO PROGRAM mechanism. The parenthesis-balance checker that was supposed to prevent this mishandles backslash-escaped quotes, so a crafted SQL query slips past validation and gives the attacker OS command execution through psql's popen(). This is the same class of bug as CVE-2025-12762 and CVE-2025-13780, just in a different code path.

Affected estate

Anyone running pgAdmin 4 with Import/Export Data functionality enabled, which is any version from when _is_query_parens_balanced() was introduced through 9.17

How to check

Check your pgAdmin version in the About dialog or with 'pip show pgadmin4'. Review which users have tools_import_export_data permission in the pgAdmin role configuration.

Included because

authenticated RCE; low-privilege requirement; common permission grants access; CVSS 9.9; same bug class as recently patched CVEs

Action

Upgrade to pgAdmin 4 version 9.18 or later. As a stopgap, revoke tools_import_export_data from all non-admin users.

Why it matters

Any authenticated user with a commonly granted permission can run arbitrary OS commands as the pgAdmin service account, giving them full control of the server.

Source

pgAdmin project advisory