SQL Injection Vulnerability in pgAdmin 4 by pgAdmin Team
CVE-2026-17351

9.4CRITICAL

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
31 July 2026

What is CVE-2026-17351?

A serious SQL injection vulnerability exists in pgAdmin 4 versions 9.13 to 9.16. This security flaw occurs due to the misalignment in parsing SQL queries between sqlparse and PostgreSQL. When specific payloads are executed via the AI Assistant's execute_sql_query tool, it can trick the system into bypassing read-only transactions. Consequently, an attacker can smuggle multiple SQL commands through what appears to be a single command, potentially compromising the integrity of the database operations. A proper fix is implemented to enforce the use of the extended query protocol, ensuring that such exploits are mitigated by rejecting multi-command inputs. Administrators are encouraged to upgrade their pgAdmin installations to the latest versions to secure their systems against this vulnerability.

Affected Version(s)

pgAdmin 4 9.13 < 9.17

References

https://github.com/pgadmin-org/pgadmin4/issues/10192
issue-tracking
https://github.com/pgadmin-org/pgadmin4/commit/ef76102bcd...
patch
https://github.com/pgadmin-org/pgadmin4/commit/bf47924444...
related

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kai Aizen (SnailSploit)
Kundan Sable <kundan.sable@enterprisedb.com>
Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Ashesh Vashi <ashesh.vashi@enterprisedb.com>
.