Is CVE-2026-7815 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7815 being exploited in the wild.

How severe is CVE-2026-7815?

High severity, with a CVSS score of 8.8, published 11 May 2026.

Which products and versions are affected?

PostgreSQL pgAdmin 4 >= 7.6, < 9.15; pgadmin4 (PyPI) < 9.15, ECOSYSTEM:introduced=0,fixed=9.15.

Is there a fix for CVE-2026-7815?

Yes. pgadmin4 (PyPI): upgrade to 9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7815 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-7815?

Check whether you run PostgreSQL pgAdmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7815: PostgreSQL pgAdmin 4 SQL injection in Maintenance Tool

Q: Is there a fix for CVE-2026-7815?

Yes. pgadmin4 (PyPI): upgrade to 9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-7815 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-7815?

Check whether you run PostgreSQL pgAdmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7815 · Severity: high · CVSS 8.8 · Published 2026-05-11

pgAdmin 4 is a popular open-source management tool for PostgreSQL databases. A security flaw in its Maintenance Tool allows an authorized user to bypass intended restrictions and execute unauthorized database commands. In a worst-case scenario, an attacker could gain full control over the underlying database server, leading to data theft, service disruption, or complete system compromise.

Technologies: PostgreSQL pgAdmin 4, pgadmin4 (PyPI). Vendors: PostgreSQL, PyPI.

Quick answers

Is CVE-2026-7815 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7815 being exploited in the wild.
How severe is CVE-2026-7815?: High severity, with a CVSS score of 8.8, published 11 May 2026.
Which products and versions are affected?: PostgreSQL pgAdmin 4 >= 7.6, < 9.15; pgadmin4 (PyPI) < 9.15, ECOSYSTEM:introduced=0,fixed=9.15.
Is there a fix for CVE-2026-7815?: Yes. pgadmin4 (PyPI): upgrade to 9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7815 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-7815?: Check whether you run PostgreSQL pgAdmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pgadmin4 (PyPI): upgrade to 9.15 or later
```
pip install "pgadmin4>=9.15"
```

Technical details

A SQL injection vulnerability exists in the pgAdmin 4 Maintenance Tool due to the improper neutralization of four user-supplied JSON fields: buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, and reindex_tablespace. These fields are concatenated directly into VACUUM, ANALYZE, or REINDEX commands which are then executed via psql. An authenticated attacker with 'tools_maintenance' permissions can break out of the command syntax to execute arbitrary SQL. This can be further escalated to remote code execution (RCE) on the database host by utilizing the 'COPY ... TO PROGRAM' command. The vulnerability is addressed in version 9.15 by implementing server-side allow-listing and proper identifier quoting.

Affected products

PostgreSQL pgAdmin 4 >= 7.6, < 9.15

Identifiers

CVE-2026-7815
GHSA-hp84-p2gq-6fvr
PYSEC-2026-2867

Timeline

2026-05-01: disclosed: Issue opened on pgAdmin 4 GitHub repository
2026-05-11: advisory: CVE published and NVD entry created
2026-05-11: patched: Fixed in pgAdmin 4 version 9.15

References

https://github.com/pgadmin-org/pgadmin4/issues/9898

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.