Is CVE-2026-12047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12047 being exploited in the wild.

How severe is CVE-2026-12047?

Low severity, with a CVSS score of 3.5, published 19 June 2026.

Which products and versions are affected?

PostgreSQL pgAdmin 4 6.6 to 9.15.

Is there a fix for CVE-2026-12047?

A patch was published on 2026-06-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12047 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12047?

Check whether you run PostgreSQL pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12047: PostgreSQL pgAdmin 4 HTML injection in cloud deployment module

CVE-2026-12047 · Severity: low · CVSS 3.5 · Published 2026-06-19

pgAdmin 4, a popular management tool for PostgreSQL databases, contains a security vulnerability in its cloud deployment module. An attacker with a valid account could provide specially crafted credentials that cause the system to display malicious HTML or scripts to the user. This could be used to redirect users to fraudulent websites or perform unauthorized actions within the management interface.

Technologies: PostgreSQL pgAdmin 4. Vendors: PostgreSQL.

Quick answers

Is CVE-2026-12047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12047 being exploited in the wild.
How severe is CVE-2026-12047?: Low severity, with a CVSS score of 3.5, published 19 June 2026.
Which products and versions are affected?: PostgreSQL pgAdmin 4 6.6 to 9.15.
Is there a fix for CVE-2026-12047?: A patch was published on 2026-06-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12047 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12047?: Check whether you run PostgreSQL pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An HTML injection vulnerability exists in pgAdmin 4 versions 6.6 through 9.15 within the cloud deployment module. Multiple endpoints (including /rds/verify_credentials, /azure/, and /google/) fail to sanitize exception text returned by AWS, Azure, and Google SDKs before including it in JSON response bodies. Because the Cloud Wizard frontend uses html-react-parser to render these messages, an attacker can provide a crafted access key containing HTML tags (e.g., <iframe>) that are echoed back in the SDK's error response and executed in the victim's browser. While primarily a self-XSS/injection risk, it could be escalated via CSRF to target other authenticated users. The fix introduces a sanitize_external_text helper to HTML-escape all external SDK and OS exception strings.

Affected products

PostgreSQL pgAdmin 4 6.6 to 9.15

Timeline

2026-06-10: patched: Fix committed to repository
2026-06-19: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.