SQL Injection Vulnerability in pgAdmin 4 by PostgreSQL
CVE-2026-17346

8.7HIGH

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
31 July 2026

What is CVE-2026-17346?

An SQL injection vulnerability exists in pgAdmin 4 affecting users with low privileges. Unrestricted creation of tables and publications allows for arbitrary SQL code execution due to insufficient input sanitization. Specifically, identifiers sourced from pg_catalog can be manipulated, enabling attackers to escape the safe template interpolation and execute arbitrary SQL within the viewer's session. Recent fixes aimed at addressing related issues have adjusted input handling, yet several template sinks remain vulnerable. It is crucial to ensure that all identified SQL templates are properly escaped to prevent potential exploitation.

Affected Version(s)

pgAdmin 4 1.0 < 9.17

pgAdmin 4 5.0 < 9.17

References

https://github.com/pgadmin-org/pgadmin4/issues/10193
issue-tracking
https://github.com/pgadmin-org/pgadmin4/commit/73b3218992...
patch
https://github.com/pgadmin-org/pgadmin4/commit/f75452bfd0...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hung Tran Quoc (@rampage0010)
Kundan Sable <kundan.sable@enterprisedb.com>
.