SQL Injection Vulnerability in pgAdmin 4 by pgAdmin

CVE-2026-7815

What is CVE-2026-7815?

An SQL injection vulnerability exists in the pgAdmin 4 Maintenance Tool, allowing an authenticated user with appropriate permissions to inject arbitrary SQL commands. By manipulating four user-input JSON fields, the attacker can execute unauthorized SQL queries on the PostgreSQL server. This exploitation could lead to the execution of OS commands on the host database, posing serious security risks. The recent fix introduces a server-side allow-list for the affected fields to mitigate this risk, enhancing the security posture of pgAdmin 4.

References