Executive brief
pgAdmin 4 is a popular open-source management tool for PostgreSQL databases. A security flaw in its Maintenance Tool allows an authorized user to bypass intended restrictions and execute unauthorized database commands. In a worst-case scenario, an attacker could gain full control over the underlying database server, leading to data theft, service disruption, or complete system compromise.
Technical details
A SQL injection vulnerability exists in the pgAdmin 4 Maintenance Tool due to the improper neutralization of four user-supplied JSON fields: buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, and reindex_tablespace. These fields are concatenated directly into VACUUM, ANALYZE, or REINDEX commands which are then executed via psql. An authenticated attacker with 'tools_maintenance' permissions can break out of the command syntax to execute arbitrary SQL. This can be further escalated to remote code execution (RCE) on the database host by utilizing the 'COPY ... TO PROGRAM' command. The vulnerability is addressed in version 9.15 by implementing server-side allow-listing and proper identifier quoting.
Affected products
- PostgreSQL pgAdmin 4 >= 7.6, < 9.15
Timeline
- 2026-05-01: disclosed: Issue opened on pgAdmin 4 GitHub repository
- 2026-05-11: advisory: CVE published and NVD entry created
- 2026-05-11: patched: Fixed in pgAdmin 4 version 9.15