SQL Injection Vulnerability in pgAdmin 4 by pgAdmin Team

CVE-2026-12050

What is CVE-2026-12050?

An SQL injection vulnerability exists in pgAdmin 4's named restore point endpoint, which allows an authenticated user to manipulate SQL statements through an insecure parameter interpolation method. Specifically, the issue arises in the 'value' field of the POST request to the endpoint '/browser/server/restore_point/{gid}/{sid}', where the value is directly formatted into the SQL string, rather than using secure binding. This leads to potential execution of unintended SQL commands within the context of the user's database role. While the exploit does not exceed the privileges of the authenticated user, it presents a considerable risk in environments where the Query Tool is deployed with restricted oversight. The patch addresses this by using bound parameters for the restore point name and ensures proper qualification of the function call, significantly raising the security posture against such injection attacks.

References