Junglewise Threat Intelligence

CVE-2026-12044: pgAdmin 4 SQL injection in multiple dialog templates and stats views

CVE-2026-12044 · Severity: high · CVSS 8.8 · Published 2026-06-19

Vendors: pgAdmin.

Executive brief

pgAdmin 4, a popular administration tool for PostgreSQL databases, is vulnerable to SQL injection. An authenticated user could provide specially crafted descriptions for database objects (like domains or triggers) to execute unauthorized commands on the underlying database server. While this typically does not grant more permissions than the user already has via the database's query tool, it can be used to bypass application-level restrictions or, in the case of administrative users, execute operating system commands on the database host.

Technical details

A SQL injection vulnerability exists in pgAdmin 4 (versions 1.0 through 9.15) across multiple Jinja2 SQL templates, including those for Domains, Foreign Tables, Languages, and Event Triggers. The root cause is the direct interpolation of user-supplied description fields into single-quoted SQL literals (e.g., '{{ data.description }}') instead of using the 'qtLiteral' escape filter. A secondary vector was identified in statistics templates (pgstattuple/pgstatindex) where identifiers containing apostrophes could break out of literals. An authenticated attacker with DDL privileges can exploit these sinks to execute arbitrary SQL under the context of their current PostgreSQL role. If the role has 'COPY FROM PROGRAM' privileges, this can lead to Remote Code Execution (RCE) on the database host. The issue is resolved in version 9.16 by enforcing 'qtLiteral' usage and hardening the driver to prevent silent unescaped returns.

Affected products

  • pgAdmin pgAdmin 4 1.0 to 9.15

Timeline

  • 2026-06-10: patched: Initial fix and code-wide audit commits submitted.
  • 2026-06-19: advisory: CVE-2026-12044 published.

References