Executive brief
pgAdmin 4, a popular management tool for PostgreSQL databases, contains a security flaw in its 'restore point' feature. An authenticated user could use this flaw to execute unauthorized database commands. While the commands run with the user's existing permissions, this could allow them to bypass certain application-level restrictions or security monitoring tools.
Technical details
A SQL injection vulnerability exists in pgAdmin 4's 'named restore point' endpoint (POST /browser/server/restore_point/{gid}/{sid}). The root cause is the use of Python's str.format() to interpolate the user-supplied 'value' field directly into a SQL string instead of using bound parameters. An authenticated attacker with an active database session can inject additional SQL statements that execute with the privileges of their current database role. While this does not typically cross a privilege boundary (as users often have direct SQL access via the Query Tool), it allows for the bypass of application-layer controls that might restrict the standard Query Tool. The vulnerability is fixed in version 9.16 by implementing parameterized queries and schema-qualifying the function call.
Affected products
- pgadmin.org pgAdmin 4 1.0 to 9.15
Timeline
- 2026-06-08: disclosed: Issue opened on GitHub
- 2026-06-18: advisory: NVD publication date
- 2026-06-19: patched: Fix released in version 9.16