By vendor

Pgadmin vulnerabilities

Known CVEs affecting Pgadmin products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-12044HIGH 8.8

  A SQL injection flaw in pgAdmin 4 allows an authenticated user to break out of database description fields by injecting a single quote, then execute arbitrary SQL commands. The vulnerability exists across 16 template locations where user-supplied descriptions are rendered directly into SQL without proper escaping—in dialogs for Domains, Foreign Tables, Languages, Event Triggers, and Views. An attacker with superuser or similar elevated database roles could escalate further to run OS commands on the PostgreSQL host. However, the flaw does not grant new database access; it only bypasses application-layer controls a DBA may have configured to restrict direct SQL execution.

• CVE-2026-12049MEDIUM 4.3

  pgAdmin 4 contains an open redirect flaw in its multi-factor authentication (MFA) flow. When a user completes MFA validation or registration, the application accepts a 'next' parameter—meant to redirect users back to their intended destination—without verifying that the target is actually part of pgAdmin. An attacker can craft a malicious link that redirects an authenticated user to an external website after they complete MFA, making the redirect appear to originate from the trusted pgAdmin domain. This is primarily a phishing amplification risk: the attacker doesn't gain access to pgAdmin or databases, but leverages pgAdmin's legitimate domain to increase the credibility of follow-on credential theft attempts.

• CVE-2026-12050MEDIUM 4.3

  A SQL injection vulnerability exists in pgAdmin 4's restore point functionality. When an authenticated user interacts with the named restore point endpoint, user-supplied input is concatenated directly into an SQL query rather than being safely parameterized. This allows an attacker to inject additional SQL statements. However, the injected SQL runs under the same database role the attacker already has access to through pgAdmin's Query Tool, so the practical impact is limited to what that role can already do. The vulnerability primarily concerns the fact that SQL execution bypasses the documented interface, which could matter for deployments that restrict Query Tool access at the application layer.

• CVE-2026-12047LOW 3.5

  pgAdmin 4's cloud deployment wizard contains an HTML injection vulnerability in its AWS, Azure, and Google Cloud credential-verification endpoints. When pgAdmin receives an error message from a cloud provider's API (such as a rejected AWS access key), it forwards that error text directly into the web interface without removing HTML tags. An authenticated attacker can craft a malicious credential submission containing HTML/iframe code; when the cloud provider rejects it and echoes back the attacker's input in its error message, pgAdmin displays that message in the wizard—parsing it as HTML. This allows the attacker to inject an iframe pointing to a malicious site, redirecting the victim's browser away from pgAdmin. The vulnerability requires the attacker to be an authenticated pgAdmin user and requires user interaction (submitting the malicious credential). Redirecting another user would require an additional cross-site request-forgery vector.