Junglewise Threat Intelligence

CVE-2026-17346: pgAdmin 4 SQL injection in Statistics and Dependencies tabs

CVE-2026-17346 · Severity: high · CVSS 8.8 · Published 2026-07-31

Executive brief

pgAdmin 4, a popular management tool for PostgreSQL databases, is vulnerable to a security flaw that could allow a low-privileged user to execute unauthorized database commands. By creating database objects (like tables or subscriptions) with specially crafted names containing apostrophes, an attacker can trigger malicious code when another user—including an administrator—views the statistics or dependencies of that object. This could lead to full database compromise, unauthorized data access, or service disruption depending on the permissions of the user viewing the malicious object.

Technical details

A SQL injection vulnerability exists in pgAdmin 4 before version 9.17 due to incomplete remediation of a previous flaw (CVE-2026-12044). The application incorrectly assumed that object names (schema, table, publication, and subscription) sourced from pg_catalog were safe and did not require escaping in certain SQL templates. A low-privileged attacker with permissions to create these objects can use apostrophes in quoted identifiers to break out of unescaped '{{ name }}' Jinja2 template interpolations. The vulnerability is triggered when any user navigates to the 'Statistics' or 'Dependencies' tabs for the malicious object. Affected components include Index Statistics (coll_stats.sql) and Publication/Subscription dependencies (dependencies.sql, get_position.sql). The fix implements qtLiteral(conn) for proper name interpolation across all affected templates.

Affected products

  • pgadmin.org pgAdmin 4 before 9.17

Timeline

  • 2026-07-25: patched: Fix committed to pgAdmin 4 repository
  • 2026-07-31: disclosed: CVE-2026-17346 published

References