HTML Injection in pgAdmin 4's Cloud Deployment Module
CVE-2026-12047

4.8MEDIUM

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
18 June 2026

What is CVE-2026-12047?

An HTML injection vulnerability exists within the cloud deployment module of pgAdmin 4. This security flaw affects endpoints such as /rds/verify_credentials/, /azure/check_cluster_name_availability, and various Google Cloud endpoints, allowing attackers to inject malicious HTML through unencoded JSON responses. When a crafted access_key is submitted by an authenticated user, an AWS STS exception message is displayed in the pgAdmin interface without proper HTML escaping. This can lead to a scenario where a specially crafted iframe source is injected, allowing redirection to an attacker-controlled site. To mitigate this issue, a patch has been introduced to sanitize external exception strings and ensure they are not rendered as HTML within the pgAdmin application.

Affected Version(s)

pgAdmin 4 6.6 < 9.16

References

https://github.com/pgadmin-org/pgadmin4/issues/10069
issue-tracking
https://github.com/pgadmin-org/pgadmin4/commit/60d149864b...
patch

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fernando Bortotti <fernando.bortotti@bsd.com.br>
Ashesh Vashi <ashesh.vashi@enterprisedb.com>
.