Quick answers
- Is CVE-2026-7816 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7816 being exploited in the wild.
- How severe is CVE-2026-7816?
- High severity, with a CVSS score of 8.8, published 11 May 2026.
- Which products and versions are affected?
- PostgreSQL pgAdmin 4 >= 9.4, < 9.15, 9.4 to < 9.15; pgadmin4 (PyPI) < 9.15, ECOSYSTEM:introduced=0,fixed=9.15.
- Is there a fix for CVE-2026-7816?
- Yes. pgadmin4 (PyPI): upgrade to 9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-7816 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-7816?
- Check whether you run PostgreSQL pgAdmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pgadmin4 (PyPI): upgrade to 9.15 or later
pip install "pgadmin4>=9.15"
Technical details
An OS command injection (CWE-78) exists in pgAdmin 4 due to improper sanitization of user-supplied input before it is interpolated into a psql \copy metacommand template. An authenticated attacker can provide a crafted query containing ") TO PROGRAM 'cmd'" to break out of the command context and execute arbitrary shell commands or write to local files. Other fields including format, on_error, and log_verbosity were also found to be vulnerable to raw interpolation. The vulnerability is fixed in version 9.15 by implementing a parenthesis-balancing parser, allow-listing specific fields, and rejecting null bytes.
Affected products
- PostgreSQL pgAdmin 4 9.4 to < 9.15
Identifiers
- CVE-2026-7816
- GHSA-j74f-g7vx-fh4x
- PYSEC-2026-2870
Timeline
- 2026-05-01: disclosed: Issue reported on GitHub
- 2026-05-11: advisory: CVE published and NVD entry created
- 2026-05-11: patched: Fixed in version 9.15