Is CVE-2026-12044 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12044 being exploited in the wild.

How severe is CVE-2026-12044?

High severity, with a CVSS score of 8.8, published 19 June 2026.

Is there a fix for CVE-2026-12044?

A patch was published on 2026-06-10: Initial fix and code-wide audit commits submitted. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12044 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12044?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12044: pgAdmin 4 SQL injection in multiple dialog templates and stats views

CVE-2026-12044 · Severity: high · CVSS 8.8 · Published 2026-06-19

pgAdmin 4, a popular administration tool for PostgreSQL databases, is vulnerable to SQL injection. An authenticated user could provide specially crafted descriptions for database objects (like domains or triggers) to execute unauthorized commands on the underlying database server. While this typically does not grant more permissions than the user already has via the database's query tool, it can be used to bypass application-level restrictions or, in the case of administrative users, execute operating system commands on the database host.

Quick answers

Is CVE-2026-12044 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12044 being exploited in the wild.
How severe is CVE-2026-12044?: High severity, with a CVSS score of 8.8, published 19 June 2026.
Which products and versions are affected?: pgAdmin pgAdmin 4 1.0 to 9.15.
Is there a fix for CVE-2026-12044?: A patch was published on 2026-06-10: Initial fix and code-wide audit commits submitted. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12044 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12044?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in pgAdmin 4 (versions 1.0 through 9.15) across multiple Jinja2 SQL templates, including those for Domains, Foreign Tables, Languages, and Event Triggers. The root cause is the direct interpolation of user-supplied description fields into single-quoted SQL literals (e.g., '{{ data.description }}') instead of using the 'qtLiteral' escape filter. A secondary vector was identified in statistics templates (pgstattuple/pgstatindex) where identifiers containing apostrophes could break out of literals. An authenticated attacker with DDL privileges can exploit these sinks to execute arbitrary SQL under the context of their current PostgreSQL role. If the role has 'COPY FROM PROGRAM' privileges, this can lead to Remote Code Execution (RCE) on the database host. The issue is resolved in version 9.16 by enforcing 'qtLiteral' usage and hardening the driver to prevent silent unescaped returns.

Affected products

pgAdmin pgAdmin 4 1.0 to 9.15

Timeline

2026-06-10: patched: Initial fix and code-wide audit commits submitted.
2026-06-19: advisory: CVE-2026-12044 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.