That's because potmeters are made to control signals, not power. There are power variable resistors, called rheostats, like in silico says, but you don't want that.
What you need is a PWM controller, for Pulse Width Modulation, which switches the pump's motor on and off at high frequency, so that the average voltage is lower than what you have now. You can control the average voltage by varying the pulse width, hence "PWM".
Least components solution is a microcontroller. Connect a potmeter to a ATTiny5 controller and let the controller create a PWM signal based on the potmeter's position. Use that signal to control a MOSFET, which works as a power switch. Three components: potmeter, controller, FET.
Many people would suggest the LM555 as an alternative, but it controls not so nicely: the frequency varies with the duty cycle, and control isn't linear. Much nicer is a triangle wave which you feed into a comparator, setting the comparator's threshold with the potmeter.
That gives you perfectly linear control at a fixed frequency.
I'm sorry if this would sound complicated to you, but for someone who's a bit familiar with electronics it's very simple, and it's the best way. The potmeter in series with the pump is a bad idea.