Is CVE-2026-17346 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17346 being exploited in the wild.

How severe is CVE-2026-17346?

High severity, with a CVSS score of 8.8, published 31 July 2026.

Which products and versions are affected?

pgadmin.org pgAdmin 4 before 9.17.

Is there a fix for CVE-2026-17346?

A patch was published on 2026-07-25: Fix committed to pgAdmin 4 repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17346 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-17346?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17346: pgAdmin 4 SQL injection in Statistics and Dependencies tabs

CVE-2026-17346 · Severity: high · CVSS 8.8 · Published 2026-07-31

pgAdmin 4, a popular management tool for PostgreSQL databases, is vulnerable to a security flaw that could allow a low-privileged user to execute unauthorized database commands. By creating database objects (like tables or subscriptions) with specially crafted names containing apostrophes, an attacker can trigger malicious code when another user—including an administrator—views the statistics or dependencies of that object. This could lead to full database compromise, unauthorized data access, or service disruption depending on the permissions of the user viewing the malicious object.

Quick answers

Is CVE-2026-17346 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17346 being exploited in the wild.
How severe is CVE-2026-17346?: High severity, with a CVSS score of 8.8, published 31 July 2026.
Which products and versions are affected?: pgadmin.org pgAdmin 4 before 9.17.
Is there a fix for CVE-2026-17346?: A patch was published on 2026-07-25: Fix committed to pgAdmin 4 repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17346 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-17346?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in pgAdmin 4 before version 9.17 due to incomplete remediation of a previous flaw (CVE-2026-12044). The application incorrectly assumed that object names (schema, table, publication, and subscription) sourced from pg_catalog were safe and did not require escaping in certain SQL templates. A low-privileged attacker with permissions to create these objects can use apostrophes in quoted identifiers to break out of unescaped '{{ name }}' Jinja2 template interpolations. The vulnerability is triggered when any user navigates to the 'Statistics' or 'Dependencies' tabs for the malicious object. Affected components include Index Statistics (coll_stats.sql) and Publication/Subscription dependencies (dependencies.sql, get_position.sql). The fix implements qtLiteral(conn) for proper name interpolation across all affected templates.

Affected products

pgadmin.org pgAdmin 4 before 9.17

Timeline

2026-07-25: patched: Fix committed to pgAdmin 4 repository
2026-07-31: disclosed: CVE-2026-17346 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.