CVE-2026-17566
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.
Risk Assessment
An attacker with tools_import_export_data permissions can execute arbitrary system commands on the pgAdmin server, leading to full compromise of the application and potentially the database.
Recommendation
Upgrade pgAdmin 4 to version 9.18 or later immediately, which includes a fix that rejects queries with backslashes in string literals.
Other vulnerabilities in pgAdmin 4
See all- CVE-2026-7819High
There is a path traversal vulnerability using symbolic links in pgAdmin 4 File Manager. An authenticated user can create a symbolic link in their directory pointing outside of it, allowing data to be written to any path accessible by the pgAdmin process.
- CVE-2026-7818High
In pgAdmin 4 FileBackedSessionManager, there is a vulnerability to deserialization of untrusted data, which can lead to remote code execution at the operating system level. This issue arises from the lack of proper integrity checks before deserializing session file contents.
- CVE-2026-7816High
In pgAdmin 4 before version 9.15, there is an OS command injection vulnerability (CWE-78) in the Import/Export query export feature. An authenticated user could inject malicious commands, leading to arbitrary command execution on the pgAdmin server or arbitrary file writes.
- CVE-2026-7815High
A SQL injection vulnerability in the pgAdmin 4 Maintenance Tool allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL commands on the PostgreSQL server. Exploiting this vulnerability could lead to privilege escalation and execution of operating system commands on the database host.
- CVE-2026-17351Critical
A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.
- CVE-2026-17349Critical
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).
- CVE-2026-12048Critical
A stored cross-site scripting vulnerability exists in pgAdmin 4 versions 6.0 through 9.15. Text returned by a PostgreSQL server (e.g., object names in errors or EXPLAIN fields) was passed verbatim to html-react-parser, allowing injection of arbitrary HTML, including iframes. An attacker controlling the server or creating a maliciously named object can hijack the victim's pgAdmin session.
- CVE-2026-12046Critical
In pgAdmin 4 versions 6.9 through 9.15, two SQL Editor endpoints lack authentication decorators, allowing unauthenticated attackers to trigger pickle deserialization from server sessions. Exploitation requires additional preconditions (knowledge of SECRET_KEY and write access to sessions directory) to achieve remote code execution.
- CVE-2026-12045Critical
A vulnerability in the pgAdmin 4 AI Assistant allows an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The flaw stems from missing validation of LLM-generated queries, enabling bypass of read-only mode via injection of commands like COMMIT or ROLLBACK.
- CVE-2026-7813Critical
Authorization vulnerability in pgAdmin 4 server mode allows access to private objects of other users without proper filtering. An authenticated user could access another user's private servers, server groups, and background processes by guessing object IDs.
Original NVD description (English source)
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor). The fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing. This issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.